Cryptography and Lattices, CaLC 2001

Lecture Notes in Computer Science Edited by G. Goos, J. Hartmanis and J. van Leeuwen 2146 3 Berlin Heidelberg New ...

Author: Joseph H. Silverman

33 downloads 927 Views 2MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

Lecture Notes in Computer Science

Edited by G. Goos, J. Hartmanis and J. van Leeuwen

2146

3

Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Singapore Tokyo

Joseph H. Silverman (Ed.)

Cryptography and Lattices International Conference, CaLC 2001 Providence, RI, USA, March 29-30, 2001 Revised Papers

13

Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands Volume Editor Joseph H. Silverman Brown University, Mathematics Department - Box 1917 Providence, RI 02912, USA E-mail: [email protected]

Cataloging-in-Publication Data applied for Die Deutsche Bibliothek - CIP-Einheitsaufnahme Cryptography and lattices : international conference, revised papers / CaLC 2001, Providence, RI, USA, March 29 - 30, 2001. Joseph H. Silverman (ed.). Berlin ; Heidelberg ; New York ; Barcelona ; Hong Kong ; London ; Milan ; Paris ; Singapore ; Tokyo : Springer, 2001 (Lecture notes in computer science ; Vol. 2146) ISBN 3-540-42488-1

CR Subject Classification (1998): E.3, F.2.1, F.2.2, G.1, I.1.2, G.2, K.4.4 ISSN 0302-9743 ISBN 3-540-42488-1 Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer-Verlag Berlin Heidelberg New York a member of BertelsmannSpringer Science+Business Media GmbH http://www.springer.de © Springer-Verlag Berlin Heidelberg 2001 Printed in Germany Typesetting: Camera-ready by author, date conversion by Christian Grosche, Hamburg Printed on acid-free paper SPIN 10840224 06/3142 543210

Preface These are the proceedings of CaLC 2001, the ﬁrst conference devoted to cryptography and lattices. We have long believed that the importance of lattices and lattice reduction in cryptography, both for cryptographic construction and cryptographic analysis, merits a gathering devoted to this topic. The enthusiastic response that we received from the program committee, the invited speakers, the many people who submitted papers, and the 90 registered participants amply conﬁrmed the widespread interest in lattices and their cryptographic applications. We thank everyone whose involvement made CaLC such a successful event; in particular we thank Natalie Johnson, Larry Larrivee, Doreen Pappas, and the Brown University Mathematics Department for their assistance and support.

March 2001

Jeﬀrey Hoﬀstein, Jill Pipher, Joseph Silverman

VI

Preface

Organization CaLC 2001 was organized by the Department of Mathematics at Brown University. The program chairs express their thanks to the program commitee and the additional external referees for their help in selecting the papers for CaLC 2001. The program chairs would also like to thank NTRU Cryptosystems for providing ﬁnancial support for the conference.

Program Commitee • Don Coppersmith IBM Research • Jeﬀrey Hoﬀstein (co-chair) <[email protected]>, <[email protected]> Brown University and NTRU Cryptosystems • Arjen Lenstra <[email protected]> Citibank, USA • Phong Nguyen ENS • Andrew Odlyzko AT&T Labs Research • Joseph H. Silverman (co-chair) <[email protected]>, <[email protected]> Brown University and NTRU Cryptosystems

External Referees Ali Akhavi, Glenn Durfee, Nick Howgrave-Graham, Daniele Micciancio

Sponsoring Institutions NTRU Cryptosystems, Inc., Burlington, MA <www.ntru.com>

Table of Contents

An Overveiw of the Sieve Algorithm for the Shortest Lattice Vector Problem Mikl´ os Ajtai, Ravi Kumar, and Dandapani Sivakumar

1

Low Secret Exponent RSA Revisited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Johannes Bl¨ omer and Alexander May

4

Finding Small Solutions to Small Degree Polynomials . . . . . . . . . . . . . . . . . . . 20 Don Coppersmith Fast Reduction of Ternary Quadratic Forms . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Friedrich Eisenbrand and G¨ unter Rote Factoring Polynomials and 0-1 Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Mark van Hoeij Approximate Integer Common Divisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Nick Howgrave-Graham Segment LLL-Reduction of Lattice Bases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Henrik Koy and Claus Peter Schnorr Segment LLL-Reduction with Floating Point Orthogonalization . . . . . . . . . . 81 Henrik Koy and Claus Peter Schnorr The Insecurity of Nyberg-Rueppel and Other DSA-Like Signature Schemes with Partially Known Nonces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Edwin El Mahassni, Phong Q. Nguyen, and Igor E. Shparlinski Dimension Reduction Methods for Convolution Modular Lattices . . . . . . . . 110 Alexander May and Joseph H. Silverman Improving Lattice Based Cryptosystems Using the Hermite Normal Form . 126 Daniele Micciancio The Two Faces of Lattices in Cryptology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Phong Q. Nguyen and Jacques Stern A 3-Dimensional Lattice Reduction Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 181 Igor Semaev The Shortest Vector Problem in Lattices with Many Cycles . . . . . . . . . . . . . 194 M˚ arten Trolin Multisequence Synthesis over an Integral Domain . . . . . . . . . . . . . . . . . . . . . . 206 Li-ping Wang and Yue-fei Zhu Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

An Overview of the Sieve Algorithm for the Shortest Lattice Vector Problem Mikl´ os Ajtai, Ravi Kumar, and Dandapani Sivakumar IBM Almaden Research Center 650 Harry Road, San Jose, CA 95120 {ajtai,ravi,siva}@almaden.ibm.com

We present an overview of a randomized 2O(n) time algorithm to compute a shortest non-zero vector in an n-dimensional rational lattice. The complete details of this algorithm can be found in [2]. A lattice is a discrete additive subgroup of Rn . One way to specify a lattice is vectors through a basis. A basis B = {b1 , . . . , bn } is a set of linearly independent n in Rn . The lattice generated by a basis B is L = L(B) = { i=1 ci bi | ci ∈ Z}. The shortest lattice vector problem (SVP) is the problem of ﬁnding a shortest non-zero vector (under some norm, usually 2 ) in L. The α-approximate version of SVP is to ﬁnd a non-zero lattice vector whose length is at most α times the length of a shortest non-zero lattice vector. SVP has a rich history. Gauss and Hermite studied an equivalent of SVP in the context of minimizing quadratic forms [4,7]. Dirichlet formulated SVP under the guise of diophantine approximations. Using the convex body theorem, Minkowski gave an existential bound on the shortest vector in a lattice [13]. Though the extended Euclidean GCD algorithm can be used to solve SVP in two dimensions, the ﬁrst algorithmic breakthrough in n dimensions was obtained in a celebrated result of Lenstra, Lenstra, and Lov´asz [10], who gave an algorithm (the LLL algorithm) that computes a 2n/2 -approximate shortest vector in polynomial time. This was improved in a generalization of the LLL algorithm by Schnorr [14], who obtained a hierarchy of algorithms that provide a uniform trade-oﬀ between the running time and the approximation factor. This algorithm runs in nO(1) k O(k) steps to solve a k O(n/k) -approximate SVP. For instance, a polynomial-time version of this algorithm improves the approximation 2 factor obtained by the LLL algorithm to 2n(log log n) / log n . Kannan [8] obtained O(n log n) a2 time algorithm for the exact SVP. The constant in the exponent of this algorithm was improved to about 1/2 by Helfrich [6]. Recently, Kumar and Sivakumar solved the decision version of n3 -approximate SVP in 2O(n) time [9]. On the hardness front, SVP for the L∞ norm was shown to be NP-complete by van Emde Boas [3]. Ajtai [1] proved that SVP under the 2 norm is NP-hard under randomized reductions. Micciancio √ [12] showed that the α-approximate SVP remains NP-hard for any α < 2. Lagarias, Lenstra, and Schnorr [11] showed that n-approximate SVP is unlikely to be NP-hard. Goldreich and Goldwasser [5] showed that n/ log n-approximate SVP is unlikely to be NP-hard. We sketch a randomized 2O(n) algorithm for SVP (in 2 norm) for a lattice L in Rn . In fact, in 2O(n) time, our algorithm can ﬁnd all α-approximate shortest vectors for any constant α ≥ 1. J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 1–3, 2001. c Springer-Verlag Berlin Heidelberg 2001

2

Mikl´ os Ajtai, Ravi Kumar, and Dandapani Sivakumar

We make a few simplifying assumptions about the lattice L: (1) the length of shortest vector is at least 1 and at most 2 — this can be realized by appropriately scaling L; (2) the length of the longest vector in the basis is at most 2O(n) — this can be realized by appropriate applications of the LLL algorithm. We create a large (sides of exponential length) parallelepiped P that is fairly close to being a cube. Then we uniformly sample a large number of lattice points z1 , . . . , zN , N = 2O(n) , from P ∩ L, and to each sample zi , we add a uniform perturbation vector yi of expected length O(1) to obtain a sequence of points x1 , . . . , xN . For each perturbed lattice point xi , we will keep track of two lattice points: its “true identity” zi , and an “approximator” ai , initially set to 0. Then, we use the following sieve procedure — given suﬃciently many points in Rn of length at most R, identify a small set of “representatives” from the set of points and a large set of “survivors” such that for every survivor point, there is a representative at distance at most R/2. We repeatedly apply the sieve to the vectors xi − ai ; for each survivor xi − ai with representative xj − aj , we know that the distance between xi − ai and xj − aj is about half the distance between xi and ai . Therefore, ai + xj − aj is a better approximation to xi , and since xj is close to its true identity zj , we deﬁne the new approximator for xi to be ai + zj − aj . In these steps, once the true identity of a point is revealed, we will not use it in the future. We repeat this process until the distance between the points and their approximators are bounded by another constant. Finally, if xi still survives and has an approximator ai , output the lattice point wi = zi − ai . Since both zi and ai are close to xi , with high probability, the length of wi is bounded by a constant. We will denote this process as the basic algorithm. Note that if the basic algorithm stops with a non-zero wi , we already have a constant factor approximation algorithm for SVP. To ensure that wi is non-zero with good probability and to obtain the shortest vector, we make the following argument. Let u denote a shortest vector in L. Let w = wi be a lattice point of constant length that is output by the procedure above. Let x be a sample point from which w was obtained, and let z ∈ L be the true identity of x. Since the perturbations are small, we can argue that the probability (conditioned on x being a sample) that one of z ± u is the true identity of x is at least 2−O(n) times the probability that z is the true identity of x. Furthermore — and this is the crucial point — the basic algorithm is oblivious to the true identity of x. Using this fact, we will argue that for some w, w + u has at least 2−O(n) times the probability of w to be the output of the basic algorithm. Since the number of lattice points in the ball of constant radius around the origin is at most 2O(n) , we obtain that there is at least one w ∈ L whose probability of being output is at least 2−O(n) and w + u has the probability of being output at least 2−O(n) . Therefore, by repeating the basic algorithm 2O(n) times we can ensure that with high probability both w and w + u are output. Thus, the ﬁnal algorithm is the following: repeat the basic algorithm 2O(n) times, take all possible pairwise diﬀerences of the points output by the basic algorithm, and output the shortest of these vectors. More details of this algorithm can be found in [2].

An Overview of the Sieve Algorithm for the Shortest Lattice Vector Problem

3

References 1. M. Ajtai. The shortest vector problem in L2 is NP-hard for randomized reductions. Proc. 30th ACM Symposium on Theory of Computing, pp. 10–19, 1998. 2. M. Ajtai, R. Kumar, and D. Sivakumar. A sieve algorithm for the shortest lattice vector problem. Proc. 33rd ACM Symposium on Theory of Computing, 2001. To appear. 3. P. van Emde Boas. Another NP-complete partition problem and the complexity of computing short vectors in lattices. Mathematics Department, University of Amsterdam, TR 81-04, 1981. 4. C. F. Gauss. Disquisitiones Arithmeticae. English edition, (Translated by A. A. Clarke) Springer-Verlag, 1966. 5. O. Goldreich and S. Goldwasser. On the limits of nonapproximability of lattice problems. Journal of Computer and System Sciences, 60(3):540–563, 2000. 6. B. Helfrich. Algorithms to construct Minkowski reduced and Hermite reduced bases. Theoretical Computer Science, 41:125–139, 1985. 7. C. Hermite. Second letter to Jacobi, Oeuvres, I, Journal f¨ ur Mathematik, 40:122– 135, 1905. 8. R. Kannan. Minkowski’s convex body theorem and integer programming. Mathematics of Operations Research, 12:415–440, 1987. Preliminary version in ACM Symposium on Theory of Computing 1983. 9. R. Kumar and D. Sivakumar. On polynomial approximations to the shortest lattice vector length. Proc. 12th Symposium on Discrete Algorithms, 2001. 10. A. K. Lenstra, H. W. Lenstra, and L. Lov´ asz. Factoring polynomials with rational coeﬃcients. Mathematische Annalen, 261:515–534, 1982. 11. J. C. Lagarias, H. W. Lenstra, and C. P. Schnorr. Korkine-Zolotarev bases and successive minima of a lattice and its reciprocal lattice. Combinatorica, 10:333– 348, 1990. 12. D. Micciancio. The shortest vector in a lattice is hard to approximate to within some constant. Proc. 39th IEEE Symposium on Foundations of Computer Science, pp. 92–98, 1998. 13. H. Minkowski. Geometrie der Zahlen. Leipzig, Teubner, 1990. 14. C. P. Schnorr. A hierarchy of polynomial time basis reduction algorithms. Theoretical Computer Science, 53:201–224, 1987.

Low Secret Exponent RSA Revisited Johannes Bl¨omer and Alexander May Department of Mathematics and Computer Science University of Paderborn, 33095 Paderborn, Germany {bloemer,alexx}@uni-paderborn.de

Abstract. We present a lattice attack on low exponent RSA with short secret exponent d = N δ for every δ < 0.29. The attack is a variation of an approach by Boneh and Durfee [4] based on lattice reduction techniques and Coppersmith’s method for finding small roots of modular polynomial equations. Although our results are slightly worse than the results of Boneh and Durfee they have several interesting features. We partially analyze the structure of the lattices we are using. For most δ < 0.29 our method requires lattices of smaller dimension than the approach by Boneh and Durfee. Hence, we get a more practical attack on low exponent RSA. We demonstrate this by experiments, where δ > 0.265. Our method, as well as the method by Boneh and Durfee, is heuristic, since the method is based on Coppersmith’s approach for bivariate polynomials. Coppersmith [6] pointed out that this heuristic must fail in some cases. We argue in this paper, that a (practically not interesting) variant of the Boneh/Durfee attack proposed in [4] always fails. Many authors have already stressed the necessity for rigorous proofs of Coppersmith’s method in the multivariate case. This is even more evident in light of these results. Keywords: Low secret exponent RSA, cryptanalysis, Coppersmith’s method, lattice reduction.

1

Introduction

In this paper we consider the problem of breaking the RSA cryptosystem for short secret keys. An RSA public key is a pair (N, e) where N = pq is a product of two n-bit primes. The corresponding secret key d is chosen such that it satisﬁes the equation ed ≡ 1 (mod 12 φ(N )), where φ(N ) = (p − 1)(q − 1). The ﬁrst result showing that RSA is insecure, if the secret key is too small, is due to Wiener. In 1990, Wiener [20] showed that d < 13 N 0.25 leads to a polynomial time attack on the RSA system. Wiener’s method is based on continued fractions. Basically, Wiener showed that d is the denominator of some convergent of the continued fraction expansion of e/N . A variant of Euclid’s algorithm computes the continued fraction expansion of a number. Since N, e both are public, this shows that d can be computed eﬃciently from the public key (N, e). J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 4–19, 2001. c Springer-Verlag Berlin Heidelberg 2001

Low Secret Exponent RSA Revisited

5

Recently, Boneh and Durfee [4] proposed an attack on RSA, that shows that RSA is insecure provided d < N 0.292 . Unlike Wiener’s attack, the attack by Boneh and Durfee is a heuristic. It builds upon Coppersmith’s result for ﬁnding small solutions of modular polynomial equations [6]. Coppersmith’s method for the univariate case is rigorous but the proposed generalization for the multivariate case is a heuristic. More precisely, Boneh and Durfee show that for a small secret key d, the number s = − p+q 2 can be found as a small solution to some modular bivariate polynomial equation. Once s is known, one can immediately solve the equations s = − p+q 2 and N = pq for the unknowns p and q. Using Coppersmith’s method, which in turn is based on the famous L3 -lattice reduction algorithm, Boneh and Durfee reduce the problem of ﬁnding s to ﬁnding a common root of two bivariate polynomials f (x, y), g(x, y) over the integers. As proposed by Coppersmith, ﬁnding a common root of f, g is done by ﬁrst computing the resultant r(y) of f, g with respect to the variable x. Provided r ≡ 0, the parameter s, and hence the factorization, can be found by computing the roots (over Z) of r. Unfortunately, this method, as well as any other method based on Coppersmith’s approach for multivariate polynomials1 , fails if the resultant r is identically 0. As it has never been proved that r ≡ 0, the Boneh/Durfee approach is heuristic. In this paper we study the method by Boneh and Durfee in more detail. In Section 4, we propose a new lattice for cryptanalysing low secret exponent RSA with d < N 0.290 . The new approach uses the same heuristical assumption as Boneh/Durfee. Although the new attack does not improve the bound d < N 0.292 of Boneh and Durfee [4], it has several advantages. First, the lattice dimension is reduced. Therefore, in practice we are able to get closer to the theoretical bounds. Second, the new lattice basis is triangular. This leads to rather simple proofs. Third, the new lattice basis takes advantage of special properties of the lattice vectors. We believe that some of our structural results in Section 4 can be applied to other applications of Coppersmith’s method as well. Actually, Boneh and Durfee present three diﬀerent variations of the Coppersmith methodology to break RSA versions with small secret exponent d. The ﬁrst one works for d < N 1/4 , hence this variant basically reproduces Wiener’s result. The second variation of Boneh and Durfee works for d < N 0.284 . Finally they have a method that works for d up to N 0.292 . We made the experimental observation, that the ﬁrst method of Boneh and Durfee, supposed to work for d < N 1/4 always failed. In fact, in all experiments the resultant r mentioned above was identically zero. Although one cannot recover the factorization by resultant computation, we show that RSA with secret key d < 13 N 1/4 can be broken using lattice reduction in dimension 2. In fact, we show that for an appropriately chosen lattice, a shortest vector in the lattice immediately reveals the secret key d. Since we have not found examples where the other two variants for d < N 0.284 and d < N 0.292 described by Boneh and Durfee fail, this observation in no way invalidates the results of Boneh and Durfee. On the other hand, this is 1

This includes among others [1,4,8,12].

6

Johannes Bl¨ omer and Alexander May

to our knowledge the ﬁrst case mentioned in literature, that an application of Coppersmith’s approach fails in general. Some authors [6,14] already pointed out that the heuristic must fail in some cases, but no general failure has been reported for real applications of the method. Although we are not quite able to rigorously analyze the Boneh and Durfee method for d < N 1/4 , in Section 5 we prove several results that almost completely explain the behavior observed in experiments. Many authors already stressed the necessity of a rigorous analysis of methods based on Coppersmith’s approach in the multivariate case. This is even more evident in light of our results. In Section 6 we give experimental results for our new attack on RSA with short secret key d. We carried out cryptanalysis of secret keys up to d ≤ N 0.278 . We also compared our experimental results with the experimental results of Boneh and Durfee. In [3], they only provided examples with d ≤ N 0.265 . In all cases we considered, our method was faster.

2

The Boneh-Durfee Lattice

In this section we review the lattice attack by Boneh and Durfee on low exponent RSA. For an introduction into lattice theory and lattice basis reduction, we refer to the textbooks [9,17]. Descriptions of Wiener’s RSA attack and the method of Coppersmith can be found in [6,20]. For a good overview of RSA attacks, we refer to a survey article of Boneh [2]. Let d < eδ . We assume that the size of e is in the order of the size of N . If e is smaller, the attack of Boneh and Durfee becomes even more eﬀective (see [4], section 5). All known attacks on RSA with short secret exponent focus on the identity N +1 φ(N ) ⇔ ed + k + s = 1, (1) ed = 1 mod 2 2 where k ∈ Z, s = − p+q 2 and d are unknown quantities. Since e < k < d. Boneh and Durfee [4] look at equation (1) modulo e. N +1 + s − 1 = 0 mod e k 2

φ(N ) 2 ,

we obtain

They deﬁne the polynomial f (x, y) = x(A + y) − 1 with A = N2+1 . Let X = eδ and Y = e0.5 . We know, that f has a root (x0 , y0 ) = (k, s) modulo e, that satisﬁes |x0 | < X and |y0 | < Y . To transform the modular equation into an equation over the integers, Boneh/Durfee use a theorem of Howgrave-Graham [11]. Given a polynomial p(x, y) = i,j ai,j xi y j , we deﬁne the norm ||p(x, y)||2 = i,j a2i,j .

Low Secret Exponent RSA Revisited

7

Theorem 1 (Howgrave-Graham [11]). Let p(x, y) be a polynomial which is a sum of at most w monomials. Suppose that p(x0 , y0 ) = 0 mod em √ for some positive integer m, where |x0 | < X and |y0 | < Y . If ||p(xX, yY )|| < em / w, then p(x0 , y0 ) = 0 holds over the integers. Next, Boneh and Durfee deﬁne polynomials gi,k (x, y) = xi f k (x, y)em−k

and hj,k (x, y) = y j f k (x, y)em−k

for a given positive integer m. In the sequel, the polynomials gi,k are referred to as x-shifts and analogously the polynomials hj,k are referred to as y-shifts. By construction, the point (x0 , y0 ) is a root of all these polynomials modulo em . Thus, we can apply Howgrave’s theorem and search for a small norm linear combination of polynomials gi,k (xX, yY ) and hj,k (xX, yY ). This is done by using the L3 lattice reduction algorithm. The goal√is to construct a lattice that is guaranteed to contain a vector shorter than em / w. Boneh and Durfee suggest to build the lattice spanned by the coeﬃcient vectors of the polynomials gi,k , hj,k for certain parameters i, j and k. For each k = 0, . . . , m, they use the x-shifts gi,k (xX, yY ) for i = 0, . . . , m−k. Additionally, they use the y-shifts hj,k for j = 0, . . . , t for some parameter t. In the sequel, we call the lattice constructed by Boneh and Durfee the lattice LBD . The basis for LBD is denoted by BBD . The lattice LBD is spanned by the row vectors of BBD . Since the lattice depends on the parameters m and t, we sometimes refer to the parameters by BBD (m, t) to clarify notation. It is easy to see, that the basis vectors of lattice LBD form a triangular matrix. We give an example of the lattice basis for the parameter choice m = 2 and t = 1. BBD (2, 1) =   1 x xy x2 x2 y x2 y 2 y xy 2 x2 y 3 2 2   e e   2 2   xe e X     f e −e eAX eXY   2 2 2 2  x e e X   2 2   xf e −eX eAX eX Y   2 2 2 2 2 2   f 1 −2AX −2XY A X 2AX Y X Y     ye2 2 e Y     yf e 2 eAXY −eY eXY 2 2 2 2 2 2 2 3 yf −2AXY A X Y 2AX Y Y −2XY X Y Boneh and Durfee showed for δ < 0.284, one can ﬁnd m, t such that an L3 -reduced basis of LBD contains vectors short enough to apply Howgrave’s theorem and factor the modulus N . This was improved in the same paper to δ < 0.292 by using non-triangular lattice bases. This is up to now the best

8

Johannes Bl¨ omer and Alexander May

bound for cryptanalysis of low secret exponent RSA. The attack works under the assumption that polynomials obtained from two suﬃciently short vectors in the reduced basis have a non-vanishing resultant. Although heuristic, no failure of the method for suﬃciently large δ is known. Boneh and Durfee also argue that using t = 0, that is only x-shifts are used to construct a lattice basis, one obtains already an attack working for δ < 0.25. This reproduces Wiener’s result. However, experiments show that the method of Boneh and Durfee never works when using only x-shifts. In Section 5, we will explain why this is the case. Of course, this failure of the Boneh/Durfee method in the special case where only x-shifts are used does not aﬀect the method in general. It only points out that one has to be careful when using Coppersmith’s heuristic in the multivariate case.

3

Notations

Since the lattice LBD deﬁned in Section 2 is the starting point of our further constructions, we introduce some notations on the rows and columns of the lattice basis BBD . We refer to the coeﬃcient vectors of the polynomials gi,k (xX, yY ) as the X-block. The X-block is further divided into Xl , l = 0, . . . , m, blocks, where the block Xl consist of the l + 1 coeﬃcient vectors of gi,k with i + k = l. These l + 1 vectors are called Xl,k , that is the k-th vectors in the Xl block is the coeﬃcient vector of gl−k,k . The coeﬃcient vectors of the polynomials hj,k form the Y -block. We deﬁne the Yj block as the block of all m + 1 coeﬃcient vectors of polynomials that are shifted by y j . The k-th vector in the block Yj is called Yj,k , it is identical to the coeﬃcient vector of hj,k . Every column in the basis BBD is labeled by a monomial xi y j . All column vectors with label xl y j , l ≥ j, form the X (l) column block. Analogously, we deﬁne the Y (l) column block to consist of all column vectors labeled with xi y i+l . In the example in Section 2, the horizontol lines divide the basis BBD (2, 1) into the blocks X1 , X2 , X3 and Y1 . Similarly, the vertical lines divide BBD (2, 1) into the column blocks X (1) , X (2) , X (3) and Y (1) . In this example, the basis entry in row Y1,2 and column x2 y is A2 X 2 Y .

4

A New Method for All δ < 0.290

We introduce an alternative method for factoring the modulus N if d < N 0.290 . This does not improve the bound δ < 0.292 given by Boneh and Durfee. However, it has several advantages compared to their approach. First, our method signiﬁcantly reduces the lattice dimension as a function of m and t. The practical implication is that we are able to get closer to the theoretical bound. We give experimental results for δ > 0.265. Second, our proofs are simple. As opposed to the Boneh/Durfee lattices for δ < 0.292, the lattice

Low Secret Exponent RSA Revisited

9

bases we use in the attack for δ < 0.290 remain triangular. Hence, determinant computations are simple. Third, our construction makes use of structural properties of the underlying polynomials. Thus, it should apply also to other lattice constructions using these polynomials. Construction of the new lattice L with basis B 1. Choose lattice parameters m and t and build the Boneh-Durfee lattice basis BBD (m, t) as explained in Section 2. 2. In the Yt block of the basis BBD remove every vector except for the last vector Yt,m , in the Yt−1 block remove every vector except for the last two vectors Yt,m−1 and Yt,m , and so on. Finally, in the Y1 block remove every vector except for the last t vectors Ym−t+1 , . . . , Ym . 3. Remove every vector in the X-block except for the vectors in the t + 1 blocks Xm−t , Xm−t+1 , . . . , Xm . 4. Delete columns in such a way that the resulting basis is again triangular. This is, remove all column blocks X (0) , X (1) , . . . , X (m−t−1) . Furthermore in the column block Y (l) , l = 1, . . . , t, remove the columns labeled with xi y i+l for 0 ≤ i < m − t + l. This construction leads to a triangular basis B of a new lattice L, which will be used in our approach. Since B depends on m and t, we sometimes write B(m, t). As opposed to Boneh and Durfee, we do not integrate more y-shifts to improve the bound δ < 0.284, instead we remove some x-shifts. Remark 1. In our construction, we take the pattern (p0 , p1 , . . . , pt ) = (1, 2, . . . , t + 1). That is, we take the last pi , 0 ≤ i < t vectors from the Yt−i block and the last pt X-blocks and delete columns appropriately. The proofs in this section easily generalize to every strictly increasing pattern (p0 , p1 , . . . , pt ), p0 < p1 < · · · < pt . This includes among others the pattern used by Boneh/Durfee [4] to show the bound d < N 0.292 . We give the proof of this generalization in the full version of the paper. Applying the construction to the example given in Section 2, we obtain the following lattice basis of L with parameters m = 2 and t = 1. 

x e2 X eAX

xy

x2

x2 y

x2 y 2

x2 y 3



  xe2     fe eXY   2 2 2 2  x e e X B(2, 1) =    2 2   xf e −eX eAX eX Y   2   f −2AX −2XY A2 X 2 2AX 2 Y X 2 Y 2 2 2 2 2 2 2 3 yf −2AXY A X Y 2AX Y X Y

10

Johannes Bl¨ omer and Alexander May

¯ be the non-triangular basis we obtain after Step 3 of the construction. Let B ¯ consists of the remaining basis vectors of BBD in the construction That is, B after removing row vectors but without removing columns. The lattice spanned ¯ is called LB¯ . We adopt the notations of Section 3 for by the row vectors of B ¯ For example, the row vector Xl,k of B is the the rows and columns of B and B. coeﬃcient vector of gl−k,k , where we removed all the entries speciﬁed in Step 4 of the construction. In the basis B(2, 1) above, the row vector X2,0 is the vector (0, 0, e2 X 2 , 0, 0, 0). ¯ but not in the We call a column vector xi y j that appears in the basis B ¯ basis B a removed column of B. The bases B and B are constructed using the same coeﬃcient vectors, where in B certain columns are removed. Having a cb b in the span of B, one can compute the corresponding linear vector u = b∈B ¯ with the same coeﬃcients cb . Hence, combination u¯ = b∈B¯ cb b of vectors in B the vector dimension of u ¯ is larger than the vector dimension of u. One can regard the additional vector entries in u ¯ as a reconstruction of the vector entries of u in the removed columns. Therefore, we call u ¯ the reconstruction vector of u. The row vectors Xl,k , (l = m − t, . . . , m; k ≤ l) and Yj,k , (j = 1, . . . , t; k = m − t + j, . . . , m) form the basis B. These vectors are no longer the coeﬃcient vectors of the polynomials gl−k,k (xX, yY ) and hj,k (xX, yY ), respectively, since we remove columns in Step 4 of the construction. However in order to apply Howgrave’s theorem, we must ensure that we construct a linear combination of bivariate polynomials that evaluates to zero modulo em at the point (x0 , y0 ) = (k, s). Hence, we still have to associate the rows Xl,k and Yj,k with the polynomials gl−k,k and ¯ represent the coeﬃcient vectors of these polynohj,k . The basis vectors of B mials. Therefore, after ﬁnding a small vector u = b∈B cb b in L, we compute the reconstruction vector u ¯ = b∈B¯ cb b in LB¯ . That is, we reconstruct the entries in the removed columns. Once the reconstruction vectors of two suﬃciently short vectors in L are computed, the rest of our method is the same as in the Boneh/Durfee method. In the remainder of this section we show that short vectors u in L lead to short reconstruction vectors u¯ in LB¯ . To prove this, we ﬁrst show that removed columns of B are small linear combinations of column vectors in B. We give an example for the removed column x0 y 0 in B(2, 1). Applying the construction in the following proof of Lemma 2, we see that this column is a linear combination of the columns x1 y 1 and x2 y 2 in B.       0 0 0  −e     eXY  0        0      1 1 0 0  =− −     0      2 2 0 0 XY     X Y    1   X 2Y 2   −2XY  0 −2AXY 2AX 2 Y 2

Low Secret Exponent RSA Revisited

11

Lemma 2. All removed columns in the column blocks X i , i < m − t, are linear combinations of columns in B. Moreover, in these linear combinations, the coeﬃcient for a column vector in X (l) , l ≥ m − t, can be bounded by (XY1)l−i · c, where c depends only on m and t. Proof: If xi y j is a removed column of B, we show that xi y j is a linear combination of columns xi+1 y j+1 , . . . , xm y m−i+j . If xi+1 y i+1 is a removed column, we can repeat the argument to show that xi+1 y i+1 is a linear combination of the remaining columns xi+2 y j+2 , . . . , xm y m−i+j . Continuing in this way until all removed columns have been represented as linear combinations of columns in B, proves the lemma. Hence, it suﬃces to prove the following claim. Claim 1. If xi y j is a removed column of B, then xi y j is a linear combination of the columns xi+1 y j+1 , xi+2 y j+2 ,. . . , xm y m−i+j , where the coeﬃcient of column xi+b y j+b , b = 1, . . . , m − i, is given by j+b 1 − . j (XY )b Note, that the coeﬃcient cb = j+b depends only on m and t, since i, j depend j on m and t. We will prove Claim 1 by showing that for each row in B(m, t) the entry of the column xi y j in this row is a linear combination of the entries of the columns xi+b y j+b in this row, with the coeﬃcients as in the claim. We prove this for the rows in the X-block and Y -block separately. Let Xl,k be a row in block Xl , where l ≥ m − t. The coeﬃcients in this row are the coeﬃcients of the polynomial em−k xl−k f k (xX, yY ). By deﬁnition of f this polynomial is p k p p−q p q p+l−k q m−k l−k k m−k k+p k e x f (xX, yY ) = e (−1) y . A X Y x p q p=0 q=0 (2) To obtain the coeﬃcient of xi+b y j+b in em−k xl−k f k (xX, yY ), we set p = i − l + k + b and q = j + b. Hence, this coeﬃcient is given by k i − l + k + b i−l+k−j i−l+k+b j+b em−k (−1)i−l+b X Y A i−l+k+b j+b k i−l+k+b = em−k Ai−l+k−j X i−l+k Y j (−1)i−l (−1)b (XY )b . i−l+k+b j+b We can ignore the factor em−k Ai−l+k−j X i−l+k Y j (−1)i−l , common to all entries in row Xl,k in the columns xi+b y j+b . Then Claim 1 restricted to row Xl,k reads as k i−l+k i−l+k j m−i j+b k i−l+k+b 1 b+1 = (−1) (XY )b j i−l+k+b j+b (XY )b b=1

12

Johannes Bl¨ omer and Alexander May

k is non-zero only for k ≥ i − l + k + b, we Since the binomial coeﬃcient i−l+k+b only have to sum up to b ≤ l − i. Substituting i − l + k by i yields k−i k i k i +b b+1 j + b (−1) = . i j i + b j j+b

(3)

b=1

Subtracting the left-hand side, Claim 1 restricted to row Xl,k reduces to 0=

k−i

b+1

(−1)

b=0

j+b k i +b . j i + b j+b

(4)

One checks that j+b i +b k − i k! k . = (k − i )!j!(i − j)! b j+b j i + b This shows k−i

(−1)b+1

b=0

k−i j+b k k! i +b b k−i (−1) = − . j i + b j+b (k − i )!j!(i − j)! b

b=0

= (1 + (−1))b = 0 we get equation (4). Since (−1)b k−i b In the same manner, Claim 1 is proved for the Y -block. Let Yl,k be a row in block Yl . Analogously to equation (2), we get e

m−k l k

y f (xX, yY ) = e

m−k

p k p=0 q=0

k+p

(−1)

k p p−q p q p q+l A X Y x y . p q

We obtain the coeﬃcients of xi+b y j+b in em−k y l f k (xX, yY ) by setting p = i + b and q = j − l + b. Again, we ignore the common factors in e, A, X and Y . Now, Claim 1 for Yl,k reduces to m−i k i j+b k i+b (−1)b+1 = i j−l j i+b j−l+b b=1

k is zero for k < i+b. We only have to sum up to b ≤ k −i, because the factor i+b Substituting j − l by j and i by i yields equation (3). This concludes the proof.

Lemma 3. Every removed column vector xi y i+l , i < m− t+ l, is a linear combination of the columns in the column block Y (l) of B. In this linear combination, the coeﬃcient for a column vector xk y k+l , k ≥ m − t + l, can be bounded by 1 (XY )k−i · c, where c depends only on m and t. Proof: Analogously to the proof of Lemma 2. Therefore we omit it.

Low Secret Exponent RSA Revisited

13

Theorem 2. Let u = b∈B cb b be a linear combination of vectors in B with u < em . For ﬁxed m and t and for every removed column xi y j in the X (i) i j block (0 ≤ i < m − t), the entry x y in the reconstruction vector u¯ = b∈B¯ cb b can be bounded by O

em (XY )m−t−i

.

Proof: Consider a removed column xi y j . Let v = (v1 , v2 , . . . , vn )T be the col¯ where the entries are multiplied by the coeﬃcients cb . We umn vector xi y j in B, n m want to show that | k=1 vk | = O( (XY e)m−t−i ). This will prove the theorem. Apply Lemma 2 and write v as a linear combination of the t+1 columns xm−t y m−t−i+j , . . . , xm y m−i+j in B, where again the entries in each of the t + 1 vectors are multiplied by the coeﬃcients cb . Call these columns wi = (wi,1 , . . . , wi,n )T for i = 0, . . . , t. Applying Lemma 2 yields v=

d1 dt d0 w0 + w1 + · · · + wt (XY )m−t−i (XY )m−t−i+1 (XY )m−i

According to Lemma 2, the di are constant for ﬁxed m and t. By assumption m m ||u|| < e . Hence, all components of u are less than e . From this, we obtain | k wi,k | < em . This implies dt d0 vk = w + · · · + w 0,k t,k (XY )m−t−i (XY )m−i k k k dt d0 + · · · + w w ≤ 0,k t,k (XY )m−i (XY )m−t−i k k d0 dt ≤ em + · · · + em m−t−i m−i (XY ) (XY ) em em + · · · + O =O (XY )m−t−i (XY )m−i m Therefore, | k vk | can be bounded by O (XY e)m−t−i . Theorem 3. Let u = b∈B cb b be a linear combination of vectors in B with u < em . For ﬁxed m and t and for every removed column xi y i+l in the Y (l) block (0 ≤ i < m − t + l, 1 ≤ l ≤ t), the entry xi y i+l in the reconstruction vector em u ¯ = b∈B¯ cb b can be bounded by O (XY )m−t+l−i . Proof: Analogously to the proof of Theorem 2. The proof is omitted. From Theorems 2 and 3, we can conclude that if we use the reconstruction vector u ¯ instead of the short vector u, we do not enlarge the norm signiﬁcantly. This shows the correctness of our approach. m be a vector in L. Then the Corollary 4. Let u = b∈B cb b with u < e em u < em + O( XY ). reconstruction vector u ¯ = b∈B¯ cb b satisﬁes ¯

14

Johannes Bl¨ omer and Alexander May

4.1

Computation of the New Bound

Since the lattice basis for L is triangular, computing the determinant of lattice L is easy. We do not carry out the computation. Manipulating the expressions for the determinant is straightforward, but requires tedious arithmetic. The lattice dimension w equals the number of vectors in the two sets of blocks Xm−t , . . . , Xm and Y1 , . . . , Yt , so w=

m

(i + 1) +

i=m−t

t

i = (m + 1)(t + 1)

i=1

Notice that we have w = (m + 1)(m + 2)/2 + t(m + 1) for the lattice LBD . We compute the determinant det(L) as a function of e, m, t and δ. We ﬁnd the optimal t as a function of m, δ by elementary calculus. Analogously to the method of Boneh/Durfee, we solve the equation det(L) < emw for the maximal value of δ. This leads to the bound √ 6−1 ≈ 0.290. δ< 5

5

A Case Where the Heuristic Fails

As mentioned before, if LBD is constructed using only x-shifted polynomials gi,k then the Boneh/Durfee method always failed in our experiments. More precisely, the polynomials we obtained from the two shortest vectors in an L3 -reduced basis for LBD led to two polynomials whose resultant with respect to x was identically 0. We want to explain this phenomenon. Using the construction of Section 4 in the special case of t = 0 and m = l1 , the lattice L consists only of the vectors in the block Xl1 with the columns in X (l1 ) . A simple determinant computation shows, that for every Xl1 block there is a linear combination of vectors in block Xl1 that is shorter than em provided δ < 0.25. Moreover, unless a combination of vectors in block Xl2 is much shorter than em )), combinations of vecem (according to Theorem 2 it must be of size O( XY tors from diﬀerent blocks Xl1 , Xl2 can not be shorter than vectors obtained as combinations of vectors from a single block Xl1 . Although not a rigorous proof, this explains the following observation. In our experiments every vector in an L3 -reduced basis for BBD (m, 0) was a combination of basis vectors from a single block Xl1 2 . 2

In fact, the following was true for arbitrary LBD , even those constructed using yshifts: Every vector in an L3 -reduced basis for LBD that depended only on basis vectors in the X-block was a combination of basis vectors from a single block Xl1 .

Low Secret Exponent RSA Revisited

15

Now assume that we compute the resultant of two polynomials p1 , p2 , ob√ tained from vectors v1 , v2 whose length is smaller than em / w and that are linear combinations of basis vectors in Xl1 and Xl2 , respectively. By construction of LBD and Howgrave’s theorem (Theorem 1), p1 and p2 have a common root (x0 , y0 ) = (k, s). The following theorem shows that in this case the Boneh/Durfee attack fails. Theorem 4. Let p1 (x, y) and p2 (x, y) be polynomials that are non-zero linear combinations of the Xl1 and Xl2 block, respectively. If p1 (x0 , y0 ) = p2 (x0 , y0 ) = 0 for at least one pair (x0 , y0 ) ∈ C × C then Resx (p1 , p2 ) = 0. Proof: Write p1 and p2 as linear combinations p1 (x, y) =

l1

ci xl1 −i f i (x, y)em−i , p2 (x, y) =

i=0

l2

di xl2 −i f i (x, y)em−i .

i=0

We know l1 , l2 > 0, since p1 (x0 , y0 ) = p2 (x0 , y0 ) = 0 for at least one pair (x0 , y0 ). If c0 = d0 = 0, then f is a common factor of p1 and p2 and Resx (p1 , p2 ) = 0. Hence, we may assume c0 = 0 or d0 = 0. Let r(y) = Resx (p1 , p2 ) be the resultant of p1 , p2 with respect to the variable x. Let T = {z ∈ C | r(z) = 0} be the set of roots of r(y). Next, deﬁne S as S = {y ∈ C | there is an x ∈ C such that p1 (x, y) = p2 (x, y) = 0}. S is the projection of the common roots of p1 , p2 onto the second coordinate. It is well-known that S ⊆ T (see for example [7]). Our goal is to show, that |S| = ∞. Then |T | = ∞ as well, and r(y) = Resx (p1 , p2 ) = 0 as stated in the theorem. To show that |S| = ∞, we ﬁrst perform the transformation τ deﬁned by x ,y . τ (x, y) = (x , y) with (x , y) = f (x, y) We obtain x =

1 x = x(A + y) − 1 A+y−

1 x

.

This implies 1 1 =A+y− x x From the second equality we get x=

x (A

and

1 1 = A+y − . x x

x x = . + y) − 1 f (x , y)

We also get f (x , y) =

1 1 x · (A + y) − 1 = = . x(A + y) − 1 x(A + y) − 1 f (x, y)

16

Johannes Bl¨ omer and Alexander May

Applying the transformation to the polynomials p1 , p2 gives rational polynomials q1 , q2 , where q1 (x , y) = f −l1 (x , y)

l1

ci x

l1 −i m−i

e

,

i=0

q2 (x , y) = f −l2 (x , y)

l2

di x

l2 −i m−i

e

.

i=0

Hence q1 , q2 are of the form q1 (x , y) = nomials g1 , g2 that depend only on x . Let

1 f l1

g1 (x ), q2 (x , y) =

1 g (x ), f l2 2

for poly-

S = {y ∈ C | there is an x ∈ C such that q1 (x, y) = q2 (x, y) = 0}. If g1 , g2 do not have a common root, then S = ∅. On the other hand, if g1 , g2 have a common root x then S = C\{ x1 − A}, since y = x1 − A is the only value y for which f (x, y) = 0. In particular, either S = ∅ or |S | = ∞. In order to show that |S | = ∞, it suﬃces to show that there is at least one y ∈ S . In order to prove the theorem, it suﬃces to show that the transformation τ induces a bijective mapping of the common roots of p1 , p2 onto the common roots of q1 , q2 . By assumption, p1 and p2 share the common root (x0 , y0 ). Then, τ (x0 , y0 ) is a common root of q1 , q2 . This implies y0 ∈ S and therefore |S | = ∞. By the bijectivity of τ , we get |S| = ∞ as well. Whenever deﬁned, the transformation τ is the inverse of itself. This implies that τ is bijective on its domain, that is on all points (x, y) where f (x, y) = 0. Hence, a common root (x, y) of p1 , p2 is not in the domain of τ iﬀ (x, y) is a root of f . So assume (x, y) ∈ C × C is such that f (x, y) = 0. Then all term in p1 and p2 vanish except for i = 0. We get p1 (x, y) = c0 xl1 em and p2 (x, y) = d0 xl2 em . But f (x, y) = x(A + y) − 1 = 0 implies x = 0. In this case, p1 and p2 do not have a common root because either c0 = 0 or d0 = 0. Hence p1 , p2 , f do not have a common root and the transformation τ induces a bijective mapping of the common roots of p1 , p2 onto the common roots of q1 , q2 . This concludes the proof of the theorem. More can be said about the Boneh/Durfee attack when LBD is constructed using only x-shifts. In the experiments we carried out, an L3 -reduced basis of LBD always contained a vector v depending only on the basis vectors in X1 . As usually, we denote the basis vectors in X1 by X1,0 , X1,1 . The vector v was of the form d · X1,0 + k · X1,1 , where d is the secret key and k is deﬁned by ) ed = 1 − k φ(N 2 . Hence, v alone reveals the secret key. This is explained by the following theorem. Consider the lattice L spanned by the rows of the (2 × 2) lattice basis eX 0 B(1, 0) = . AX XY

Low Secret Exponent RSA Revisited

17

Theorem 5. If we choose Y = e1/2 and X = 2e1/4 for the basis B(1, 0), then the coeﬃcients of the shortest lattice vector equal the secret parameters k and d provided d < 13 N 1/4 . Proof: We only sketch the proof idea. Details are given in the full version of the paper. We show that for the shortest vector u = c1 X1,0 + c2 X1,1 the quotient c1 /c2 is a convergent in the continued fraction expansion of A/e. Furthermore, c1 /c2 is the last convergent of A/e whose denominator is less than e1/4 . It can be shown using Wiener’s argument, that d/k is also the last convergent of A/e with denominator less than e1/4 . This implies c1 /c2 = d/k.

6

Experiments

We implemented our new method and carried out several experiments on a Linux-PC with 550 MHz. The L3 reduction was done using Victor Shoup’s NTL library [18]. em . InterIn every experiment, we found two vectors with norm smaller than √ w estingly in the experiments carried out, the reduced lattice basis contained not only two suﬃciently small vectors, but all vectors in the L3 -reduced basis of L had about the same norm. This is a diﬀerence to the Boneh/Durfee lattice bases. The resultant of the corresponding polynomials was computed using the Maple computer algebra system. The resultant with respect to x was always a polynomial in y, and the root delivered the factorization of N . Our results compare well to those of Boneh and Durfee in the Eurocrypt paper [3]. Boneh/Durfee ran new experiments in [4], but used additional tricks to enlarge d by a few bits: 1. Lattice reduction with Schnorr’s block reduction variant [16]. 2. Use of Chebychev polynomials (a trick due to Coppersmith). √ 3. If p(xX, yY ) < c · em / w, we know |p(x0 , y0 )| < c · em and p(x0 , y0 ) = 0 mod em . Hence, we can guess γ ∈ (−c, c) such that p(x, y) + γem satisﬁes p(x0 , y0 ) + γem = 0 over Z. These tricks apply to our method as well, but we did not implement them. Comparing instances with the same bitsize of p, q and the same δ as in [3], our algorithm was several times faster due to the reduced lattice dimension. Table 1 contains several running times we obtained. Where availabe, we also included the corresponding running times as provided in [3] (these running times were achieved on a 400 MHz SUN workstation). In all examples we chose d uniformly with δ log(N ) bits, until logN (d) was δ within precision at least 10−4 . The running time measures only the time for L3 -reduction. With growing m and t, the time for resultant computation can take longer than reducing the lattice basis B(m, t).

18

Johannes Bl¨ omer and Alexander May

Table 1. Results of Experiments. p, q 1000 bits 3000 bits 3000 bits 500 bits 500 bits 500 bits 500 bits

δ 0.265 0.265 0.269 0.270 0.274 0.2765 0.278

m 4 4 5 6 8 10 11

t 2 2 2 2 3 4 5

w 15 15 18 21 36 55 72

our running time running time in [4] 6 minutes 45 minutes 100 minutes 300 minutes 8 hours — 19 minutes — 300 minutes — 26 hours — 6 days —

Acknowledgement We want to thank Glenn Durfee for pointing out the additional tricks in Section 6 and the anonymous referees for their helpful comments.

References 1. D. Bleichenbacher, “On the Security of the KMOV public key cryptosystem”, Proc. of Crypto’97 2. D. Boneh, “Twenty years of attacks on the RSA cryptosystem”, Notices of the AMS, 1999 3. D. Boneh, G. Durfee, “Cryptanalysis of RSA with private key d less than N 0.292 ”, Proc. Eurocrypt’99 4. D. Boneh, G. Durfee, “Cryptanalysis of RSA with private key d less than N 0.292 ”, IEEE Trans. on Information Theory, vol. 46(4), 2000 5. H. Cohen, “A Course in Computational Algebraic Number Theory”, Springer Verlag, 1996 6. D. Coppersmith, “Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities”, Journal of Cryptology 10(4), 1997 7. D. Cox, J. Little, D. O’Shea, “Ideals, Varieties and Algorithms”, Springer Verlag, 1992 8. G. Durfee, P. Nguyen, “Cryptanalysis of the RSA Schemes with Short Secret Exponent from Asiacrypt’99”, Proc. of Asiacrypt 2000 9. M. Gruber, C.G. Lekkerkerker, “Geometry of Numbers”, North-Holland, 1987 10. G.H. Hardy, E.M. Wright, “An Introduction to the Theory of Numbers”, Oxford University Press, 1979 11. N. Howgrave-Graham, “Finding small roots of univariate modular equations revisited”, Proc. of Cryptography and Coding, LNCS 1355, Springer-Verlag, 1997 12. C. Jutla, “On finding small solutions of modular multivariate polynomial equations”, Proc. of Eurocrypt’98 13. A. Lenstra, H. Lenstra and L. Lovasz, “Factoring polynomials with rational coefficients”, Mathematische Annalen, 1982 14. P. Nguyen, J. Stern, “Lattice Reduction in Cryptology: An Update”, Algorithmic Number Theory Symposium ANTS-IV, 2000 15. R. Rivest, A. Shamir and L. Adleman, “A method for obtaining digital signatures and public key cryptosystems”, Communications of the ACM, volume 21, 1978

Low Secret Exponent RSA Revisited

19

16. C.P. Schnorr, “A hierarchy of polynomial time lattice basis reduction algorithms”, Theoretical Computer Science, volume 53, 1987 17. C.L. Siegel, “Lectures on the Geometry of Numbers”, Springer Verlag, 1989 18. V. Shoup, Number Theory Library (NTL), http://www.cs.wisc.edu/~shoup/ntl 19. E. Verheul, H. van Tilborg, “Cryptanalysis of less short RSA secret exponents”, Applicable Algebra in Engineering, Communication and Computing, Springer Verlag, vol. 8, 1997 20. M. Wiener, “Cryptanalysis of short RSA secret exponents”, IEEE Transactions on Information Theory, vol. 36, 1990

Finding Small Solutions to Small Degree Polynomials Don Coppersmith IBM Research, T.J. Watson Research Center Yorktown Heights, NY 10598, USA [email protected]

Abstract. This talk is a brief survey of recent results and ideas concerning the problem of ﬁnding a small root of a univariate polynomial mod N , and the companion problem of ﬁnding a small solution to a bivariate equation over Z. We start with the lattice-based approach from [2,3], and speculate on directions for improvement. Keywords: Modular polynomials, lattice reduction.

1

Univariate Modular Polynomial

Our basic setup is a univariate polynomial p(x) of small degree d, and a modulus N of unknown factorization. For a suitable bound B, we wish to ﬁnd all integers x0 such that |x0 | < B and p(x0 ) = 0 mod N . (Call such integers “small roots”.) Our eﬀorts will be concentrated in increasing the bound B. An early paper in this line of research was [2], but the author was working with an unnatural space. Here we follow the more natural presentation of Howgrave-Graham [8]. For simplicity we assume p is monic, although we really only need that the gcd of its coeﬃcients be relatively prime to N ; see Remark 1 below. We set p(x) = xd + pd−1 xd−1 + · · · + p2 x2 + p1 x + p0 . The ﬁrst approach is essentially due to H˚ astad [7]: Consider ﬁrst the collection C1 of polynomials: C1 = {xi , 0 ≤ i < d} ∪ {p(x)/N }. For each polynomial q ∈ C1 , for each small root x0 , we see that q(x0 ) is an integer. The same will be true of any integer linear combination of polynomials in C1 . J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 20–31, 2001. c Springer-Verlag Berlin Heidelberg 2001

Finding Small Solutions to Small Degree Polynomials

21

So it makes sense to consider the lattice of dimension d + 1 generated by the columns of the matrix   1 0 0 ··· 0 0 p0 /N 0 B 0 ··· 0  0 p1 B/N   2  0 0 B2 · · · 0  0 p B /N 2     . .. L1 =  .    0 0 0 · · · B d−2 0 pd−2 B d−2 /N     0 0 0 · · · 0 B d−1 pd−1 B d−1 /N  0 0 0 ··· 0 0 1B d /N Each column corresponds to a polynomial q(x) in C1 , expressed in the basis {xi /B i }. So row i corresponds to the coeﬃcient of xi in q(x), multiplied by a scaling factor B i . Now apply lattice basis reduction [13]. Because L1 has dimension d + 1 and determinant N −1 B d(d+1)/2 , we will ﬁnd a nonzero vector v of length 1/(d+1)

|v| < c1 (d) (det L1 )

= c1 (d)N −1/(d+1) B d/2 ,

where c1 (d) is a constant depending only on the dimension. 2 d Wei interpret the vector v = [v0 , v1 B, v2 B i, . . .i, vd B ] as a polynomial v(x) = vi x , again expressing v(x) in the basis {x /B }. Suppose we know that 1/(d+1)

c1 (d) (det L1 ) or equivalently,

<

1 , d+1

B ≤ c1 (d)N 2/[d(d+1)] ,

where c1 (d) is another constant depending only on d. Then we also know that |v| < 1/(d + 1), and each entry of v satisﬁes |vi B i | < 1/(d + 1). Evaluate the polynomial v(x) at a small root x0 . On one hand |v(x0 )| ≤

|vi xi0 | ≤

|vi B i | <

1 = 1, d+1

so that |v(x0 )| < 1. On the other hand, v(x0 ) is an integer. These two conditions together imply that v(x0 ) = 0 ∈ Q. In summary: We have computed a polynomial v(x) in Q[x] whose roots include all “small roots” x0 , that is, all those x0 with |x0 | < B = c1 (d)N 2/d(d+1) and with p(x0 ) = 0 mod N . Incidentally, we have also bounded the number of small roots, by dim L1 . Remark 1: If p(x) is not monic, but its content is relatively prime to N , we augment C1 with xd , that is, we replace C1 by C1 = {xi , 0 ≤ i ≤ d} ∪ {p(x)/N }. One checks that the corresponding lattice L1 still has dimension d + 1 and determinant N −1 B d(d+1)/2 , and the rest of the argument goes through.

22

Don Coppersmith

Remark 2: Using the Cauchy-Schwarz inequality, one can replace the condition c1 (d) (det L1 )1/(d+1) <

1 d+1

by the weaker condition c1 (d) (det L1 )

1/(d+1)

1 <√ . d+1

Remark 3: Sometimes we scale thing diﬀerently, using C1 = {N xi , 0 ≤ i < d} ∪ {p(x)} and using the fact that for each q ∈ C1 and small root x0 we have that q(x0 ) is a multiple of N . The two approaches are numerically equivalent, the only diﬀerence being esthetics.

2

Improvements in the Exponent

The ﬁrst improvement comes when we consider a larger collection of polynomials. Deﬁne C2 = {xi , 0 ≤ i < d} ∪ {(p(x)/N )xi , 0 ≤ i < d}. The corresponding lattice L2 has dimension 2d and determinant N −d B 2d(2d−1)/2 . The enabling condition becomes

1/(2d) 1 , < c2 (d) N −d B 2d(2d−1)/2 2d or equivalently

B ≤ c2 (d)N 1/(2d−1) .

The exponent of N has improved from 2/d(d + 1) to 1/(2d − 1). The improvement came about because the dimension of L increased, while its determinant decreased. We obtain a second improvement by considering higher powers of the modulus N , along with a still larger collection of polynomials. Fix a positive integer h. Deﬁne C3 = {(p(x)/N )j xi , 0 ≤ i < d, 0 ≤ j < h}. For each polynomial q(x) ∈ C3 , for each small root x0 , we see that q(x0 ) is an integer. Again the same holds for any integer linear combination of polynomials in C3 . The corresponding lattice L3 has dimension dh and determinant N −dh(h−1)/2 B (dh)(dh−1)/2 . (The powers of N on the diagonal consist of d each of N 0 , N −1 , . . . , N −(h−1) , while the powers of B are B 0 , B 1 , . . . , B dh−1 .) Our enabling equation is now: 1/(dh) N −dh(h−1)/2 B (dh)(dh−1)/2 < c3 (d, h),

Finding Small Solutions to Small Degree Polynomials

23

which will be satisﬁed if B ≤ c3 (d, h)N (h−1)/(dh−1) . h−1 d−1 1 , diﬀers from d1 by d(dh−1) < dh ; this The exponent of N , namely dh−1 diﬀerence can be made arbitrarily small by choosing h larger, at the expense of computational complexity. Put another way, we achieve a bound

B = c3 (d, )N (1/d)−

1 . The running time is polynomial in (d, 1/, log N ). by choosing h = O d We can extend the bound to N 1/d by breaking the interval of size 2N 1/d into N intervals of size 2N (1/d)− . This is still polynomial time, but in practice it gets much more expensive as the exponent gets closer to 1/d. As before, we have bounded the number of small roots, as well as showing how to compute them all in polynomial time. The existential results match those of Konyagin and Steger [12], who bound the number of small roots by 1 + log B O . log(1 + B −1 N 1/d )

1 (1/d)+ their For B = N (1/d)− their

is essentially O d , while for B = N bound N log N . bound becomes O d

3

Minor Improvements

We can improve the lower order factor—the c(d) factor in the estimate of the bound B—by more careful consideration of the process. One idea, due independently to Hendrik Lenstra [15] and to Nick HowgraveGraham [9], is to recognize that, for each positive integer k, the rational polynomial bk (x) = x(x − 1) · · · (x − k + 1)/k! takes on integer values for all integer arguments x. So we augment (say) the collection of polynomials C3 = {(p(x)/N )j xi , 0 ≤ i < d, 0 ≤ j < h}, with the polynomials bk (x), 0 ≤ k < dh, that is C3 = {(p(x)/N )j xi , 0 ≤ i < d, 0 ≤ j < h} ∪ {bk (x), 0 ≤ k < dh}. (Assume here that N is free of small factors, that is, N is relatively prime to (dh−1)!.) Whereas L3 could be represented by an upper triangular matrix whose kth diagonal element is B k N −k/d , one ﬁnds that L3 can be represented by an upper triangular matrix whose kth diagonal element is (1/k!)B k N −k/d . This decreases det(L3 ) by a factor k!. 0≤k
24

Don Coppersmith

This allows us to increase B in compensation, by a factor 2/[(dh)(dh−1)] dh dh . k! ≈ 3/2 ≈ 4.5 e 0≤k

Phong Nguyen [17] reports that in practice this does speed up computations, by perhaps a factor of 5. Nguyen also remarks that one could further augment C3 with the polynomials {bj (p(x)/N )bi (x)}, but that one does not thereby change the lattice L3 . Another idea, developed here in its explicit form but related to earlier work by Boneh [1], is probably less proﬁtable. We have used the fact that the monomials (x/B)i are bounded by 1 when |x| < B. The Chebyshev polynomials [18] share that property, but more eﬃciently. These polynomials are deﬁned by: Tk (cos θ) = cos(kθ), Tk (x) = 2k−1 xk + smaller terms(k ≥ 1). Where we currently use the monomial basis—row i corresponds to (x/B)i —to express q(x) ∈ C as a column of L, we can instead use the Chebyshev basis—row i corresponds to Ti (x/B). This will decrease det(L) by a factor 20+0+1+2+···+(dh−2) = 2(dh−1)(dh−2)/2 , leading to an increase in B by a factor of 2(dh−2)/(dh) ≈ 2. The two ideas can be applied simultaneously, and the improvements accumulate. But they increase B by only a polynomial factor, and therefore improve running time only by that factor. The same eﬀect could be achieved by solving several polynomials p(x − 2iB), |i| ≤ k/2 over the range |x| < B and using the result to solve the single polynomial p(x) over the larger range |x| < kB.

4

Speculative Improvement of Exponent

Can we improve the asymptotic bound B = N 1/d ? The bound is a naturallooking bound, and it matches the existential results of Konyagin and Steger [12]. Indeed, even in the simple case p(x) = x3 − A (mod N ), we don’t know an eﬃcient way of ﬁnding roots x larger than B = N 1/3 , while those smaller than B = N 1/3 are trivially found by solving x3 − A = 0 over the integers. The following example gives cause for pessimism. Set N = q 3 with q prime, and set p(x) = x3 + Dqx2 + Eq 2 x with D, E ∈ Z. Clearly if x0 is any multiple of q then p(x0 ) = 0 (mod N ). So if we select a bound B = N (1/3)+ , the number of “small roots” x0 with |x0 | < B and p(x0 ) = 0 (mod N ) is about 2N , i.e. exponentially many. (Again this essentially matches the bound of Konyagin and Steger [12].) Our lattice techniques cannot hope to ﬁnd them, since in our setup

Finding Small Solutions to Small Degree Polynomials

25

all the small roots are roots of v(x), so that the number of small roots needs to be bounded by dim(L). More generally, we can expect trouble whenever q 2 |N and p(x) has a repeated root modulo q. (We don’t know whether this family contains all the polynomials with an exponentially large number of roots smaller than N (1/d)+ .) When this happens, we know that N shares a common factor with the discriminant of p(x), Discr(p) = Res(p, p ), gcd(N, Discr(p)) > 1. So any improvement of the exponent past 1/d must somehow rule out this case. With this in mind, we hypothesize a “Discriminant Attack”: Suppose we can guarantee that we are never in the unfavorable situation. We can demand that gcd(N, Discr(p)) = 1. Equivalently, we can demand existence of D(x), E(x) ∈ Z[x] and F ∈ Z satisfying D(x)p(x) + E(x)p (x) + F N = 1; if gcd(N, Discr(p)) = 1, then D(x), E(x), F exist and are easily computed. Perhaps D, E, F can be incorporated into the construction of the lattice L, in such a way that the bound B can be improved to N (1/d)+ . But I don’t see how to do it. A related eﬀort is the “Divided Diﬀerence Attack”: Suppose we know that there are two small roots x, y, which diﬀer modulo each prime factor of N ; that is, gcd(N, x − y) = 1. Then besides the modular equations of degree d, p(x) = 0 (mod N ), p(y) = 0

(mod N ),

we get a third equation of total degree d − 1: r(x, y) =

p(x) − p(y) =0 x−y

(mod N ).

(Despite its appearance, r(x, y) is actually an integer polynomial.) We are now dealing with bivariate modular polynomials. As mentioned in [2] and in Section 6 below, our techniques can sometimes handle this, but there are no guarantees. Let’s try an example and see. Select a positive integer h. Let the family of polynomials be C = {(p(x)/N )k (r(x, y)/N ) xi y m , k + ≤ h, 0 ≤ i < d, 0 ≤ m < d − 1}. (We are not using p(y) because it is already generated by p(y) = p(x) + (y − x)r(x, y).) The polynomials of C are related to their monomial basis, which is nearly b a + ≤h+1 . xa y b ; a, b ≥ 0; d d−1

26

Don Coppersmith

where Bx , By are the bounds on |x| and |y|. The number of such monomials is roughly the area of a triangle, namely A = [d(h + 1)][(d − 1)(h + 1)]/2. (We are ignoring inaccuracies due to edge eﬀects near the hypotenuse of the triangle.) Associate with each polynomial q ∈ C the monomial corresponding to its leading term (in reverse lexicographical order). Estimate that the average exponent x (in the monomial basis) is about d(h + 1)/3, so that the average exponent of p(x) (among q ∈ C) is about h/3. Similarly the average exponent of r(x, y) is about h/3, and the average exponent of N is about −2h/3. Build the lattice L as before, incorporating the scaling factors Bx , By (the bounds on |x0 | and |y0 |). We estimate the determinant of L as BxAd(h+1)/3 ByA(d−1)(h+1)/3 N −2Ah/3 . The “enabling condition” then becomes BxAd(h+1)/3 ByA(d−1)(h+1)/3 N −2Ah/3 < c, Bxd(h+1) By(d−1)(h+1) < c N 2h , and in the limit of large h with d held ﬁxed, Bxd Byd−1 < c N 2 . If the enabling condition is satisﬁed, we will obtain an equation v1 (x, y) in Z[x, y] relating x0 and y0 for all small pairs (x0 , y0 ) satisfying our original modular equations p and r. But a single equation is not enough to solve for x0 and y0 . We have to hope that two independent equations are generated. Indeed, some work by Charanjit Jutla [11] indicates that under certain conditions we can guarantee that at least two equations v1 (x, y), v2 (x, y) will be generated, both with coeﬃcients small enough that they hold in Z. If v1 , v2 are algebraically independent, then we can solve them by using the resultant: u(y) = Res(v1, v2; x) ∈ Z[y] is a univariate equation in Z whose roots contain all y0 that participate in any small pair (x0 , y0 ) of interest. For each y0 we can then easily ﬁnd all the corresponding x0 . But we cannot always guarantee that the two equations will be algebraically independent. One can be a multiple of the other, in which case the resultant will be 0 and we will learn nothing. Let’s examine the limit of the enabling equation: Bxd Byd−1 < c N 2 . If either root were below N 1/d , the standard methods would ﬁnd it. But the present method may work when both roots are in the narrow range: N 1/d < |x0 |, |y0 | < N 1/(d−1) , so that we obtain a slight advantage. We have tried to abuse this method to obtain information that should otherwise be hard to get, and we always fail. Here are some examples.

Finding Small Solutions to Small Degree Polynomials

27

Suppose we know a root x0 with |x0 | < N 1/d , and we want to ﬁnd a second small root y0 with gcd(N, x0 − y0 ) = 1. The straightforward approach would be to divide p(y) by y − x0 (mod N ) to obtain a polynomial of degree d − 1. Our usual method will solve this as long as |y0 | < N 1/(d−1) . But using the bivariate method, we might expect to be able to ﬁnd y0 as long as |xd0 y0d−1 | < c N 2 . Since |x0 | < N 1/d , it seems superﬁcially that we can allow |y0 | > N 1/(d−1) and still satisfy our condition. But when we try it, the equations vi (x, y) = 0 that we recover always involve multiples of x − x0 = 0, giving no information about y. As a second example, suppose p(x) is of degree 2, and we are told there are two independent small roots x0 and y0 , both of size about N 2/3 . So p(x) = x2 + Ax + B = 0 Since the roots satisfy

(mod N ).

|xd0 y0d−1 | = |x20 y01 | ≈ N 2 ,

the present method should apply. But again the equations it gives are useless: multiples of x0 + y0 + A = 0, which we could have gotten from the original equation by inspection. Since both roots are small, A is also bounded by about N 2/3 , and the equation x0 +y0 = −A can be taken to hold in Z. But there may exist situations where this bivariate approach gives answers that we could not otherwise obtain. Remark 3: One relation between the “discriminant attack” and the “divided in the diﬀerence attack” is the usage of p (x) in the former case and p(x)−p(y) x−y latter case. Where the divided diﬀerence attack treats the circumstance that there exist two (small) roots that diﬀer modulo each prime factor of N , the discriminant attack demands that there not exist repeated roots, or in some sense that all roots are diﬀerent mod q.

5

Bivariate Integer Polynomials

The present author [3] applied techniques similar to those of his other paper [2], to the problem of ﬁnding a small solution to a bivariate integer polynomial p(x, y) = 0 ∈ Z. The primary application was to integer factorization when half the bits of one of the factors are known. The presentation in [3] is diﬃcult to understand. Once again HowgraveGraham’s presentation makes it more accessible, but this simpliﬁcation seems to only apply to the speciﬁc equation describing integer factorization (and some related equations), and not to the general bivariate integer polynomial.

28

Don Coppersmith

For integer factorization, suppose we have an integer N of unknown factorization N = P Q, where we have some approximation to the factors P and Q. We can write N = (P + x0 )(Q + y0 ) where x0 , y0 are small. If P = N β and Q = N 1−β , we will be able to solve this as long as 2 2 |x0 | < Bx = N β , |y0 | < By = N (1−β) . Notice that in this setup, we know the β(1 − β) log N high order bits of P , which is equivalent to knowing the β(1 − β) log N high order bits of Q. Select positive integers h, k with h < k. Deﬁne the family of polynomials C = {N h−i (P + x)i , 0 ≤ i < h} ∪ {xi−h (P + x)h , h ≤ i < k}. These polynomials, when evaluated at x = x0 , are all multiples of the (unknown) integer P h . The corresponding lattice L has dimension k and determinant k(k−1)/2 N h(h+1)/2 Bx . The enabling equation is then

N h(h+1)/2 Bxk(k−1)/2

1/k

≤ cP h = cN βh ,

Bx ≤ c N h(2kβ−h−1)/[k(k−1)] . For large h, k, we optimize this by selecting h = kβ, obtaining 2

Bx ≈ N β . The rest of the development is similar to the univariate modular case. We ﬁnd an equation in Z[x], whose roots include the root x0 of interest. Howgrave-Graham [10] develops these techniques even further, applied to the problem of an “approximate gcd”, ﬁnding a gcd when the inputs are only approximately known. The same technique can be applied, almost without change, to the problem of divisors in residue classes. Hendrik Lenstra [14] showed that if 0 < r < s < N are given positive integers, pairwise relatively prime, with s > N α and α > 1/4, the number of divisors of N equivalent to r mod s is bounded by a function of α, independent of r, s, N . Applying the present techniques we not only recover that existential bound but actually construct those divisors in polynomial time. [5] For more general bivariate integer equations, the reader is referred to the author’s earlier work [3], [4], where the development is less intuitive but handles a more general situation. The reader may also enjoy the more recent work of Elkies [6], the techniques being closely related. Elkies treats a more general setting, where instead of lattice points on a curve, he is looking for lattice points near a curve. He ﬁnds much wider applicability, including non-algebraic curves.

Finding Small Solutions to Small Degree Polynomials

6

29

Possible (and Impossible) Extensions

We can sometimes extend these techniques, to bivariate modular equations or to multivariate integer equations. But the extensions are not guaranteed to work, and in fact there are impossibility results that argue against their application to the general case. Consider the bivariate modular case. As in the example above, we can easily build a lattice consisting of multiples of N and of p(x, y) (or of their powers), and we can ﬁnd a short vector in that lattice, corresponding to a polynomial in Z satisﬁed by all small roots. But this polynomial will, in general, be diﬃcult to solve. As in the example, we can hope to ﬁnd two short vectors, corresponding to two polynomials, and we can hope that they are algebraically independent, so that taking their resultant we can recover a single polynomial in a single variable, whose roots include all those y0 belonging to a short pair of roots (x0 , y0 ). The trouble is that although we can arrange things so that two short vectors will be found, we cannot in general guarantee that the corresponding polynomials will be algebraically independent. We start with the following theorem of Manders and Adleman [16]: Theorem 1. (Manders and Adleman) The (problem of accepting the) set of Diophantine equations (in a standard binary encoding) of the form αx21 + βx2 − γ = 0 which have natural-number solutions x1 , x2 is NP-complete. Manders and Adleman go on to remark that the problem remains NP-complete even when β is given in fully factored form. We need to make minor adjustments to use this theorem. Let us ﬁrst center the range of x2 . Let δ approximate half of its range: γ 1 + δ= , 2β 2 and deﬁne x = x1 , y = x2 − δ, τ = γ − βδ. Then we are asking for existence of solutions (x0 , y0 ) to αx2 + βy − τ = 0, with |x0 | < Bx ≈ γ/α and |y0 | < By ≈ δ. (Clearly if we can compute all small solutions (x0 , y0 ) within these bounds, we can decide whether exact solutions to the original problem exist.)

30

Don Coppersmith

Now select N arbitrarily large, as long as N exceeds |αBx2 | + |βBy | + |τ |. Given the bivariate modular equation αx2 + βy − τ = 0 (mod N ), and bounds Bx , By as before, it will be hard to decide whether there are small solutions (x0 , y0 ); the reduction mod N is meaningless. Now, the bounds Bx , By stay ﬁxed as N grows arbitrarily large. Recall that in the univariate modular case, the allowable bound Bx grew with the 1/d power of N . In the bivariate modular case we cannot hope to ﬁnd a similar theorem. The achievable bounds cannot grow as N grows. Our method will derive, from the bivariate modular equation αx2 + βy − τ = 0 (mod N ), a bivariate integer equation, namely αx2 + βy − τ = 0. But it cannot enable us to solve either one. Exactly the same example shows that trivariate integer equation αx2 + βy − τ − zN = 0, is diﬃcult to solve with bounds Bx , By as before, and Bz = 2. In the work on bivariate integer equations [3], the bounds grew with the coeﬃcients of p(x, y) (in a complicated way that depended on the degree of p), and because we have an arbitrarily large coeﬃcient N here, again we cannot hope to achieve a similar theorem in the trivariate integer case. But these negative results should not dissuade us. As Jutla and others have shown, many times one can use the multivariate versions of the present techniques. A tool that has been shown to be ineﬀective in one percent of the cases, can still be quite useful in the other 99 percent. Acknowledgments The author is grateful to Joe Silverman and Phong Nguyen for prodding him to actually write down the ideas that have been ﬂoating around. Conversations with Nick Howgrave-Graham are always informative and stimulating.

References 1. Dan Boneh, personal communication. 2. D. Coppersmith, Finding a small root of a univariate modular equation. Advances in Cryptology – EUROCRYPT’96, LNCS 1070, Springer, 1996, 155-165. 3. D. Coppersmith, Finding a small root of a bivariate integer equation; factoring with high bits known, Advances in Cryptology – EUROCRYPT’96, LNCS 1070, Springer, 1996, 178-189.

Finding Small Solutions to Small Degree Polynomials

31

4. D. Coppersmith, Small solutions to polynomial equations, and low exponent RSA vulnerabilities. J. Crypt. vol 10 no 4 (Autumn 1997), 233-260. 5. D. Coppersmith, N.A. Howgrave-Graham, S.V. Nagaraj, Divisors in Residue classes—Constructively. Manuscript. 6. N. Elkies, Rational points near curves and small nonzero |x3 − y 2 | via lattice reduction, ANTS-4, LNCS vol 1838 (2000) Springer Verlag, 33-63. 7. J. H˚ astad, On using RSA with low exponent in a public key network, Advances in Cryptology – CRYPTO’85, LNCS 218, Springer-Verlag, 1986, 403-408. 8. N.A. Howgrave-Graham, Finding small solutions of univariate modular equations revisited. Cryptography and Coding LNCS vol 1355. (1997) SpringerVerlag. 131-142. 9. N.A. Howgrave-Graham, personal communication, 1997. 10. N.A. Howgrave-Graham, Approximate Integer Common Divisors, This volume, pp. 51–66. 11. C.S. Jutla, On ﬁnding small solutions of modular multivariate polynomial equations, Advances in Cryptology – EUROCRYPT’98, LNCS 1403, Springer, 1998, 158-170. 12. S.V. Konyagin and T. Steger, On polynomial congruences, Mathematical Notes Vol 55 No 6 (1994), 596-600. 13. A.K. Lenstra, H.W. Lenstra, and L. Lovasz, Factoring polynomials with rational coeﬃcients, Math. Ann. 261 (1982), 515-534. 14. H. W. Lenstra, Jr., “Divisors in Residue Classes,” Mathematics of Computation, volume 42, number 165, January 1984, pages 331-340. 15. H.W. Lenstra, personal communication. 16. K.L. Manders and L.M. Adleman, NP-Complete Decision Problems for Binary Quadratics. JCSS 16(2), 1978, 168-184. 17. Phong Nguyen, personal communication. 18. T.J. Rivlin, Chebyshev Polynomials, From Approximation Theory to Algebra and Number Theory, Wiley (1990).

Fast Reduction of Ternary Quadratic Forms Friedrich Eisenbrand 1

1

and Günter Rote

2

Max-Planck-Institut für Informatik

Stuhlsatzenhausweg 85, 66123 Saarbrücken, Germany 2

[email protected]

Institut für Informatik, Freie Universität Berlin Takustraÿ e 9, 14195 Berlin, Germany

[email protected]

Abstract

We show that a positive denite integral ternary form can O(M (s) log 2 s) bit operations, where s is the binary

be reduced with

encoding length of the form and

M (s)

is the bit-complexity of

s-bit

integer multiplication. This result is achieved in two steps. First we prove that the the classical Gaussian algorithm for ternary form reduction, in the variant of Lagarias, has this worst case running time. Then we show that, given a ternary form which is reduced in the Gaussian sense, it takes only a constant number of arithmetic operations and a constant number of binary-form reductions to fully reduce the form. Finally we describe how this algorithm can be generalized to higher dimensions. Lattice basis reduction and shortest vector computation in d−1 xed dimension d can be done with O(M (s) log s) bit-operations.

1 A

Introduction

positive denite integral quadratic form F , or form for short, is a homogeneous

polynomial

F (X1 , . . . , Xd ) = (X1 , . . . , Xd ) A (X1 , . . . , Xd )T , A ∈ Zd×d is an integral positive denite matrix, i.e., A = AT and xT Ax > 0 for all x = 0. The study of forms is a fundamental topic in the geometry of numbers (see, e.g., [2]). A basic question here is: Given a form F , what is the d minimal nonzero value λ(F ) = min{ F (x1 , . . . , xd ) | x ∈ Z , x = 0 } of the form where

which is attained at an integral vector? This problem will be of central interest in this paper.

Problem 1.

Given a form

F,

compute

λ(F ).

At least since Lenstra's [9] polynomial algorithm for integer programming in xed dimension, the study of quadratic forms has also become a major topic in theoretical computer science. Here, one is interested in the lattice variant of Problem 1, which is: Given a basis of an integral lattice, nd a shortest nonzero vector of the lattice w.r.t. the

2 -norm.

J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 3244, 2001.

c Springer-Verlag Berlin Heidelberg 2001

Fast Reduction of Ternary Quadratic Forms

In xed dimension, Problem 1 can be quickly solved if

F

is

reduced

33

(see

Theorem 4 in Section 5). In our setting, this shall mean that the product of the diagonal elements of

A

satises

d

aii ≤ γd ∆F

(1)

i=1 for some constant the

determianant

γd

depending on the dimension

of the form

F.

d

only. Here

∆F = det A is F into an

Algorithms which transform a form

equivalent reduced form are called

reduction algorithms.

In algorithmic number theory, the cost measure that is widely used in the analysis of algorithms is the number of required

algorithm

bit operations. The famous LLL

[8] is a reduction algorithm which has polynomial running time, even

in varying dimension. In xed dimension, the LLL reduction algorithm reduces

F of binary encoding size s with O(s) arithmetic operations on integers O(s). This amounts to O(M (s) s) bit-operations, where M (s) is the bitcomplexity of s-bit integer multiplication. If one plugs in the current record for M (s) = O(s log s log log s) [11], this shows that a form F can be reduced with a a form

of size

close to quadratic amount of bit-operations. A form in two variables is called a

binary form. Here one has asymptotically

fast reduction algorithms. It was shown by Schönhage [10] and independently by Yap [16] that a binary quadratic form can be reduced with

O(M (s) log s)

bit-operations, see also Eisenbrand [3] for an easier approach. In his famous

disquisitiones arithmeticae

algorithm for forms in three variables, called

[4], Gauÿ provided a reduction

ternary forms. He showed how to

compute a ternary form, equivalent to a given form, such that the rst diagonal √ 4 3 element of the coecient matrix is at most 3 ∆F . A form which is reduced in the Gaussian sense is not necessarily reduced in the sense of (1). The Gaussian notion of reduction was modied by Seeber [13] such that a reduced form satises (1) with

γ3 = 3.

Gauÿ [5] showed later that

γ3 = 2.

The reduction algorithm of Gauÿ was modied by Lagarias [7] to produce so called

quasi-reduced

forms. They satisfy the slightly weaker condition that

the rst diagonal element is at most twice the cubic root of the determinant. Lagarias proved that his modied ternary form algorithm runs in polynomial time. However, a quasi-reduced form is not necessarily reduced in the sense of (1).

Results. We prove that ternary forms can be reduced with a close to linear

amount of bit-operations, as it is the case for binary forms. More precisely, a

ternary form F of binary encoding length s can be reduced in the sense of (1) 2 16 with γ3 = 3 using O(M (s) log s) bit-operations. Unfortunately, the complexity of the proposed reduction procedure has still an extra (log s)-factor compared to the complexity of binary form reduction. However our result largely improves on the

O(M (s) s) complexity of algorithms for ternary form reduction which are

based on the LLL algorithm. We proceed as follows. First we show that the Gaussian ternary form alO(M (s) log2 s) bit-operations.

gorithm, in the variant of Lagarias [7], requires

34

Friedrich Eisenbrand and Günter Rote

This is achieved via a renement of the analysis given by Lagarias. Then we prove that, given a quasi-reduced ternary form, it takes at most

O(M (s) log s)

bit-operations to compute an equivalent reduced form. Therefore, a ternary form 2 can be reduced with O(M (s) log s) bit-operations. This improves on the best previously known algorithms. It follows that, for ternary forms, Problem 1 can 2 be solved with O(M (s) log s) bit-operations.

Finally we generalize the described algorithm to any xed dimension d. O(M (s) logd−1 s) bit-

The resulting lattice basis reduction algorithm requires operations.

Related Work. Apart from the already mentioned articles, three-dimensional

lattice reduction was extensively studied by various authors. Vallée [15] invented a generalization of the two-dimensional Gaussian algorithm in three dimensions. Vallée's algorithm requires

O(M (s) s)

bit-operations. Semaev [14] provides an

algorithm for three-dimensional lattice basis reduction which is based on pair 2 reduction. The running time of his algorithm is O(s ) bit-operations even if one uses the naive quadratic methods for integer multiplication and division. This matches the complexity of the Euclidean algorithm for the greatest common divisor.

2

Preliminaries and Notation

The letters

Z

and

Q

denote the integers and rationals respectively. The running

times of algorithms are always given in terms of the binary encoding length of the input data. The cost measure is the amount of

bit operations. The function M (s)

s-bit integer multiplication. time O(M (s)) [1].

denotes the bit-complexity of operations can be done in

All basic arithmetic

We will only consider positive denite integral quadratic forms. We identify F with its MF ∈ Zd×d such that

a form

coecient matrix

F (X1 , . . . , Xd ) = (X1 , . . . , Xd ) MF (X1 , . . . , Xd )T . size(F ) denotes the binary encoding length of MF . Two forms F and G are equivalent if there exists a unimodular matrix U ∈ Zd×d with MG = U T MF U . We say that U transforms F into G. The number ∆F = det MF The function

is the determinant of the form. The determinant is invariant under equivalence. See, e.g., [2] for more on the theory of quadratic forms. The coecient matrix MF ∈ Zd×d has a unique RT DR factorization, i.e, a factorization MF = RT DR, d×d where R ∈ Q is an upper triangular matrix with ones on the diagonal and D is a diagonal matrix. The matrix R has a unique R = RU , where U is unimodular and R is upper triangular with ones on the diagonal and 1 1 elements above the diagonal in the range (− , ]. The corresponding matrix 2 2 T R DR denes a form F which is equivalent to F . The form F is called the

normalization

Gram-Schmidt normalization

of

F.

This is the normalization step of the LLL

algorithm [8], translated into the language of quadratic forms. In xed dimension, the Gram-Schmidt normalization of a form

F

of size

s

can be computed

Fast Reduction of Ternary Quadratic Forms

with a constant number of arithmetic operations, and hence with operations. We say that a form

G

and if the product of the diagonal

2.1

A

γ -reduction elements of MG

is a

of

F,

if

G

is at most

O(M (s))

binary form

γ ∆F .

f

F

is a form in two variables. We denote binary forms with lower a11 a12 g . The binary form f is if Mf = a12 a22 satises

reduced

or

a11 ≤ a22 |a12 | ≤ 12 a11 . f

bit-

is equivalent to

Binary Forms

case letters

If

35

(2) (3)

is reduced one has

f

a11 a22 ≤ ∆f .

(4)

a12 0 1 , where r is the nearest integer to a11 , transforms to an equivalent form which is called the of f .

The unimodular matrix a binary form

1 −r

3 4

The normalization of

f

normalization

satises (3).

We have the following result of Schönhage [10] and Yap [16]. Theorem 1. Given a positive denite integral binary quadratic form f of size s, one can compute with O(M (s) log s) bit-operations an equivalent reduced form g and a unimodular matrix U ∈ Z2×2 which transforms f into g .

2.2

Ternary Forms

F 

Ternary forms will be denoted by capital letters coecient matrix

The form

F

denes

G.

Let

F

be given by its

 a11 a12 a13 MF = a12 a22 a23  . a13 a23 a33

associated binary forms fij , 1 ≤ i, j ≤ 3, i = j

coecient matrix

which have

Mfij =

By

or

aii aij . aij ajj

reducing fij in F , we mean that we compute the unimodular transformation

fij and apply it to the whole coecient matrix MF . This changes i-th and j -th row and column of MF and leaves the third diagonal element akk unchanged. It follows from Theorem 1 that such a reduction of fij in F can be done with O(M (s) log s) bit-operations on forms F of size s. −1 ∗ The adjoint F of F is dened by the coecient matrix MF ∗ = det MF ·MF and we write   A11 A12 A13 MF ∗ = A12 A22 A23  . A13 A23 A33 which reduces

only the

36

Friedrich Eisenbrand and Günter Rote

MF ∗ transforms F

3×3 is integral and positive denite. A unimodular matrix S ∈ Z T −1 ∗ ∗ into G if and only if (S ) transforms F into G . The associated ∗ ∗ such an associated form binary forms of F are denoted by fij and by

Clearly

reducing

F

in

we mean that we apply the corresponding reduction operations on F . Notice ∗ ∗ 2 that size(F ) = O(size(F )) and size(F ) = O(size(F )) and that ∆F ∗ = ∆F . The ternary form

F

is

quasi-reduced

(see [7, p. 162]) if

3 ∆F ≤ 2 3 ∆2F

a11 ≤ 2 A33

|a12 | ≤

1 2 1 2 1 2

|A13 | ≤ |A23 | ≤

(5) (6)

a11

(7)

A33

(8)

A33 .

(9)

This notion is a relaxation of Gauÿ ' concept of reduction of ternary forms, which has the constant

3

4/3

instead of 2 in (56).

Computing a Quasi-reduced Ternary Form

The Gaussian algorithm [4, Arts. 272275] for ternary form reduction proceeds ∗ by iteratively reducing the associated binary forms f12 and f32 in F . Lagarias [7] modied the algorithm by keeping the entries above and below the diagonal of the intermediate forms small so that (79) are fullled after every iteration. So we only have to see that (5) and (6) are fullled. One iterates until

A33 < 2 F

3 ∆2F .

(10)

In the following we prove that the number of iterations until a ternary form s satises (10) is O(log s). For F and its adjoint F ∗ one has

of size

A33 = ∆f12 ∗ . a11 ∆F = ∆f32 Thus reducing

f12

in

F

leaves

A33

(11)

unchanged and reducing

f12 in F ≤ 43 A33

unchanged. Furthermore, after reducing

a11

by (11), (2) and (4). Similarly, after reducing

A33 ≤

4 3

∗ f32

a11 ∆F .

∗ f32

in

F

leaves

a11

one has

(12) in

F

one has

(13)

This shows that each iteration decreases the

binary encoding length of A33 by A33 exceeds 3 ∆2F by a large amount. We make this observation more precise.

roughly a factor of 4 as long as

Fast Reduction of Ternary Quadratic Forms

Let

(i)

Akl

denote the coecients of

F∗

37

after the i-th iteration of this procedure.

By combining (12) and (13) we get the following relation (see [7, p. 166, (4.65)])

(i) ≤ ( 43 )(3/4) ∆F (A33 )1/4 .

(i) 3 if A33 ≥ 2 ∆2F , then

(i+1)

A33

Lagarias then remarks that,

(i+1)

A33

(14)

(i)

≤ ( 23 )3/4 A33

(15)

and it follows that the number of iterations is bounded by

O(s).

Lagarias does

not take full advantage of (14). By rewriting (14) in the form

(i+1) A33 4 2/3 3 ∆F we see that we can achieve

(i)

A 33 4 ≤ , 4 2/3 ∆ 3 F (i+1)

A33

4 2/3 3 ∆F in at most

≤2

(0) 2/3 (0) i = log4 log2 A33 /( 34 ∆F ) ≤ log4 log2 A33 = O(log s)

(i)

A33 ≤

8 3 ∆2F , then, by (15), the modied 3 ternary form algorithm requires at most one additional iteration to obtain an

iterations. After we have achieved equivalent quasi-reduced form.

This shows that the modied ternary form algorithm requires ations to quasi-reduce a ternary form of size

s.

O(log s)

iter-

If one iteration of the reduction

algorithm is performed with the fast reduction algorithm for binary forms one obtains the following result. Theorem 2. The modied ternary form reduction method reduces a ternary form of size s in O(M (s) log2 s) bit-operations.

Proof.

Lagarias proves that the sizes of the intermediate ternary forms are

We have seen that the number of iterations is

O(M (s) log s) 4

O(log s).

O(s).

One iteration requires

bit-operations if one uses the fast reduction for binary forms.

From Quasi-reduced to Reduced

A quasi-reduced form (or a form which is reduced in the sense of Gauÿ ) is not necessarily reduced. For example, the form

 4x 2x 0 MF = 2x x + 1 0  , 0 0 2x2 

MF ∗

F

given by

 3  2x + 2x2 −4x2 0 8x3 0  =  −4x2 0 0 4x

38

Friedrich Eisenbrand and Günter Rote

∆F = 8x3

with

is quasi-reduced, but it is far from being reduced, for x → ∞. 16 3 -reduction of a quasi-reduced with O(M (s) log s) bit-operations.

In this section we show that we can compute a ternary form

F

The following lemma states that, if

F

has two small entries on the diagonal

which belong to an associated reduced binary form, then the Gram-Schmidt normalization of

F

is reduced.

Let F be a ternary form such that f12 is reduced and a11 , a22 ≤ √ 3 ∆F for some κ. Then one has

Lemma 1.

κ

a11 a22 a33 ≤ ( 43 + 12 κ3 ) ∆F ,

for the Gram-Schmidt normalization F of F . Proof.

Let

be the

RT DR

f12

       1 0 0 a11 a12 a13 1 r12 r13 d1 0 0 a12 a22 a23  = r12 1 0  0 d2 0  0 1 r23  a13 a23 a33 0 0 1 r13 r23 1 0 0 d3 

factorization of the coecient matrix of

is reduced, and

d1 = a11 ,

d2 ≥ ∆F = d1 d2 d3

Now

F = R DR T

Since

∆f12 = d1 d2 ,

3 4

a22 .

(16)

and (16) imply

d3 ≤ Let

F.

it follows that

4 ∆F . 3 a11 a22

be the Gram-Schmidt normalization of

(17)

F,

then

2 2 2 2 a33 = d3 + (r23 ) d2 + (r13 ) d1 ≤ d3 + (r23 ) a22 + (r13 ) a11

3 1 ≤ d3 + 2 κ ∆F .

(18)

f12 is reduced we have not only a11 = a11 but also a22 = a22 since |r12 | ≤ 12 . √ 3 combining (17) and (18) and the assumption that a11 , a22 ≤ κ ∆F , one

Since By

obtains

a11 a22 a33 = a11 a22 a33 ≤ a11 a22 (d3 + 12 κ

3 ∆F )

≤ 43 ∆F + 12 κ3 ∆F = ( 43 + 12 κ3 ) ∆F . Now we are ready to prove that, given a quasi-reduced ternary form γ -reduction is readily available, for γ = 16 3 .

F,

an

equivalent

Given a quasi-reduced ternary form F of size s, one can compute with O(M (s) log s) bit-operations a 16 3 -reduction G of F .

Proposition 1.

Fast Reduction of Ternary Quadratic Forms

Proof.

Let

F

be quasi reduced and let

F . This leaves a11 unchanged √ 3 ∆F . It follows from (4) that

in

2

3 4 A33

F∗

be the adjoint of

and maybe decreases

F.

A33 .

39

∗ f32 a11 ≤

First reduce

Recall that

∗ A22 ≤ det f32 = a11 ∆F .

(19)

We normalize f12 in F . This leaves the form f13 unchanged. Also normalizing f13 in F leaves f12 unchanged. Therefore normalizing f12 and f13 in F leaves A33 = ∆f12 and A22 = ∆f13 unchanged. If, after these normalizations, f12 or f13 is not reduced, (2) must be violated and we have two diagonal elements of value at most in

F,

2

√ 3

∆.

By one more binary form reduction step performed on

we are in the situation of Lemma 1 with

κ=2

f12

or

f13

after swapping the second

and third row and column if necessary. It is clear that the computations in the

proof of Lemma 1 can be carried out in O(M (s)) bit operations. In this case we 4 16 compute a γ -reduction of F with γ ≤ 3 +4 = 3 . If f12 and f13 are reduced then (4) implies

A33 = det f12 ≥ 34 a11 a22 A22 = det f13 ≥ 34 a11 a33 We conclude from (19) that

a11 ∆F ≥ ( 34 )3 a211 a22 a33 and thus that

∆F ≥ ( 34 )3 a11 a22 a33 ≥

3 16

a11 a22 a33 ,

16 and we have a 3 -reduction of F . The overall amount of bit operations is O(M (s) log s), where the factor log s is required for the binary reduction steps

that may be necessary. By combining Theorem 2 and Proposition 1 we have our main result.

Given an integral positive denite ternary form F of size s, one can compute with O(M (s) log2 s) bit-operations a 16

3 -reduction of F .

Theorem 3.

5

Finding the Minimum of a Ternary Form

The following theorem is well known.

If F is a form in d variables with coecient matrix MF = (aij ) i=1 aii ≤ γ ∆F , then

Theorem 4.

such that

d

√ λ(F ) = min F (x1 , . . . , xd ) |xi | ≤ γ , xi ∈ Z, i = 1, . . . d .

If the dimension is xed and

F

is reduced, then Theorem 4 states that

λ(F )

can be quickly computed from a constant number of candidates. This gives rise to the next theorem.

40

Friedrich Eisenbrand and Günter Rote

The minimum λ(F ) of a positive denite integral ternary form F of binary encoding length s can be computed with O(M (s) log2 s) bit-operations, where M (s) is the bit-complexity of s-bit integer multiplication. Theorem 5.

Proof.

16 3 -reduction G of F . Now λ(F ) = λ(G) and by Theorem 4, the minimum of G is attained at an 16 3 integral vector x ∈ Z with |xi | ≤ 3 , i = 1, . . . , 3. By Theorem 3, all this can 2 be done with O(M (s) log s) bit-operations.

6

Given a ternary form

F

of size

s,

we rst compute a

Fast Reduction in Any Fixed Dimension

In this section we sketch how the previous technique can be generalized to any xed dimension. It is more convenient to describe this in the language of lattices. Λ ⊆ Qd is a set of the For this we review some terminology. A k d×k form Λ = Λ(A) = {Ax | x ∈ Z }, where A ∈ Q is a rational matrix of

(rational) lattice

A is a basis of the lattice Λ and its columns Λ is integral if A ∈ Zd×k . The number k is lattice. If k = d, then Λ is full-dimensional. Let F be T quadratic form with coecient matrix A A. The lattice determinant of Λ is √ number det Λ = ∆F and the lattice basis A = (x1 , . . . , xk ) is reduced if form F is reduced. More explicitly, this means that

full column rank. The matrix

are

the

the

basis vectors. dimension of the

The lattice

k

xi ≤ γ det Λ

the the the

(20)

i=1 for some constant

γ . The Lattice Reduction Problem

is the problem of computing

a reduced basis for a given lattice. The

dual lattice

y x ∈ Z, ∀x ∈ T

6.1

of a full-dimensional lattice Λ is the lattice Λ −1 Λ }. Clearly Λ∗ = Λ(AT ) and det Λ∗ = 1/ det Λ.

∗

= { y ∈ Qd |

Lattice Reduction, Shortest Vectors, and Short Vectors

The

Shortest Vector Problem

is the problem of nding a shortest nonzero vector

of a given lattice. This is just the translation of Problem 1 into lattice ter-

d-dimensional lattice Λ always contains a x ≤ (4/3)(d−1)/4(det Λ)1/d . We call the problem of

minology. Hermite [6] proved that a (shortest) vector

x

computing a vector

with

x

with

x ≤ κ · (det Λ)1/d , where

κ

is an arbitrary constant, the

SHORT Vector Problem.

Clearly, every shortest vector is also a short vector. If a reduced lattice basis is available, a shortest vector can be computed fast, as mentioned above in Section 5 (Theorem 4). The availability of a reduced lattice bases also implies an easy solution of the Short Vector Problem, either directly by (20) or via the Shortest Vector Problem.

Fast Reduction of Ternary Quadratic Forms

41

So, the Short Vector Problem is apparently the easiest problem among the three problems Lattice Reduction, Shortest Vector, and Short Vector. We will show in Section 6.3 that Lattice Reduction (and hence the Shortest Vector Problem) can be reduced to Short Vector. In Section 6.2, we will rst describe a solution of the Short Vector Problem which proceeds by induction on the dimension, analogously to the procedure of Section 3.

6.2

Finding a Short Vector

x√ ∈ Λ of a d-dimensional d det Λ, for any constant

First we describe how one can nd a lattice vector Λ ⊆ Zd with x ≤ α (4/3)(d−1)/4

integral lattice

α > 1.

The procedure mimicks the proof of Hermite [6] who showed that such a

vector (with

α = 1)

exists, see also [12, p. 79].

The idea is to compute a sequence of lattice vectors

x0 , x1 , x2 , . . .

which

satisfy the relation 2

2

xi+1 ≤ (κd−1 )d/(d−1) (det Λ)(d−2)/(d−1) xi 1/(d−1) , for a certain constant

κd−1 .

(21)

This is the generalization of (14) to higher dimen-

sions. We rewrite (21) as

1/(d−1)2 xi √ √ ≤ . (κd−1 )(d−1)/(d−2) d det Λ (κd−1 )(d−1)/(d−2) d det Λ xi+1

xi ≤ κd ·(det Λ)1/d in i = O(log log x0 ) (d−1)/(d−2) steps, if we choose the constant κd > (κd−1 ) . We now describe how the successor of xi is computed. Let xi be given. Con∗ ∗ sider the (d − 1)-dimensional sublattice Ω of Λ dened by Arguing as in Section 3, we can obtain

Ω∗ = { y ∈ Λ∗ | y T xi = 0 }. The lattice

Ω∗

has determinant

det Ω∗ ≤ xi det Λ∗ = xi (det Λ)−1 . y˜ in Ω∗

We nd a short vector

with

˜ y ≤ κd−1 (xi (det Λ)−1 )1/(d−1) . This is a Short Vector Problem in

d−1

dimensions, which is solved inductively.

Now we repeat the same procedure, going from the dual lattice back to the original lattice: consider the

(d − 1)-dimensional

sublattice

Γ

of

Λ

dened by

Γ = { x ∈ Λ | y˜ x = 0 }, T

whose determinant satises

det Γ ≤ ˜ y · det Λ ≤ κd−1 (det Λ)(d−2)/(d−1) xi 1/(d−1) . We nd a short vector mediately yields (21).

xi+1

of

Γ

with

xi+1 ≤ κd−1 (det Γ)1/(d−1) ,

which im-

As a consequence one obtains the following proposition which generalizes Theorem 2.

42

Friedrich Eisenbrand and Günter Rote

Let d ∈ N, d ≥ 3, and let κd−1 be some constant. Suppose that, in an integral lattice Γ of dimension d − 1 with binary encoding length s, a short vector x with

Proposition 2.

x ≤ κd−1 (det Γ)1/(d−1)

can be found in Td−1 (s) bit-operations. Then, for an integral lattice basis A ∈ Zd×d with binary encoding length s, we can compute a basis B ∈ Zd×d of the generated lattice Λ such that the rst column vector x of B satises x ≤ κd (det Λ)1/d ,

in Td (s) = O(Td−1 (s) log s + M (s) log s) bit-operations, for any constant κd with κd > (κd−1 )(d−1)/(d−2) . Proof. basis

y˜

We start the sequence

A.

O(Td−1 (s) + M (s)) (d − 1)-dimensional shortest vector

can be done with

one

x0 , . . . , xk

with an arbitrary vector

x0

out of the

The successors are computed as described above. The computation of bit-operations, since this involves only problem and basic linear algebra. The

xi+1 . These computations have O(log log x0 ) times and we arrive at a lattice vector x with x ≤ κd (det Λ)1/d . Now we determine an integral vector y ∈ Zd with Ay = x. With the extended euclidean algorithm one can nd a unimodular d×d with rst column y/ gcd(y1 , . . . , yd ). The matrix B = AU is as matrix U ∈ Z claimed.

4 We can use this proposition inductively, starting with κ2 = 4/3 and T2 (s) = O(M (s) log s). We see that we can choose κd as close to (4/3)(d−1)/4 as same time bound holds for the computation of to be repeated at most

we like. So we obtain:

In a d-dimensional integral lattice Λ ⊆ Zd , a lattice vector x with x ≤ κ det Λ can be found in O(M (s) logd−1 s) time, for any constant κ > ( 43 )(d−1)/4 .

Corollary 1. √ d

6.3

Augmenting the Number of Short Vectors in the Basis

Now we generalize the approach of Section 4 to get a reduced basis. Suppose

v1 , . . . , vd of the d-dimensional lattice Λ which √ is not reduced k ≥ 1 basis vectors satisfy vi ≤ α d det Λ, 1 ≤ i ≤ k for some constant α depending on d and k only. We describe a procedure that computes a new basis v1 , . . . , vd which satises one of the following.

we have a basis

and such that the rst

(a) (b)

v1 , . . . , vd is reduced, or √ ∗ d for all 1 ≤ j ≤ k + 1 one has vj ≤ α det Λ for some constant α∗ on d and k + 1 only. Rd

which is generated by the vectors v1 , . . . , vk and ⊥ denote its orthogonal complement by L . Let v ¯j denote the projection of vj into ⊥ (1) L . Let Λ be the k -dimensional lattice generated by v1 , . . . , vk and let Λ(2) Let

L

depending

be the subspace of

Fast Reduction of Ternary Quadratic Forms

be the (d − k)-dimensional lattice generated by the vectors det Λ(1) det Λ(2) = det Λ. Let

v¯k+1 , . . . , v¯d .

43

Clearly

u¯k+1 , . . . , u¯d

be a reduced basis of Λ and suppose that u ¯k+1 is the shortest among these basis (d−k)×(d−k) denote the unimodular matrix which transforms vectors. Let U ∈ Z ∗ (¯ vk+1 , . . . , v¯d ) into (¯ uk+1 , . . . , u¯d ). The vectors vj∗ ∈ Λ dened by (vk+1 , . . . , vd∗ )

(2)

= (vk+1 , . . . , vd ) U

are of the form

vj∗ = u ¯j +

k

µij vi ,

i=1 with some real coecients

µij .

It follows that

vj = u¯k+1 +

k

{µij } vi ∈ Λ,

i=1 where

{x}

denotes the fractional part of

x.

Clearly

v1 , . . . , vk , vk+1 , . . . , vd is a basis of

Λ

and

There are two cases. If

√ d vj ≤ ¯ uj + kα det Λ. √ d ¯ uk+1 > det Λ, then for

all

j = k + 1, . . . , d,

vj ≤ (kα + 1) ¯ uj . vk+1 · · · vd ≤ α2 det Λ(2) for some constant α2 since u ¯k+1 , . . . , u ¯d (1) Now let v1 , . . . , vk be a reduced basis of Λ . Then

Thus we get is reduced.

v1 · · · vd ≤ α1 det Λ(1) α2 det Λ(2) = α1 α2 det Λ, v1 , . . . , vd is reduced √ and thus (a) holds. If, on the other hand, ¯ uk+1 ≤ d det Λ, then the basis v1 , . . . , vk , vk+1 ,

. . . , vd satises (b).

which means that

Now it is clear how to proceed. We nd the rst short basis vector by Propo-

sition 2, and we iterate the above procedure as long as case (b) prevails, increasing

k.

We must eventually √ end up with a reduced basis, because as soon as

reaches

d,

we have

vi ≤ α d det Λ for all

basis vectors

vi ,

the basis is reduced. In this way, we have reduced the Lattice Reduction Problem in dimension to one

2d)

d-dimensional

k

and this implies that

d

Short Vector Problem and a constant number (fewer than

of lower-dimensional lattice reduction problems, plus some linear algebra

which can be done in

O(M (n))

time. Thus we obtain the following theorem by

induction on the dimension.

Let d ∈ N, d ≥ 2, A ∈ Zd×d be a lattice basis generating Λ and suppose that the binary encoding length of A is s. Then one can compute with O(M (s) logd−1 s) bit-operations a reduced basis of Λ or a shortest vector of Λ. Theorem 6.

44

Friedrich Eisenbrand and Günter Rote

References 1. A.V. Aho, J.E. Hopcroft, and J.D. Ullman. The Design and Analysis of Computer Algorithms. Addison-Wesley, Reading, 1974.

2. J.W.S. Cassels. Rational quadratic forms. Academic Press, 1978. 3. F. Eisenbrand. Short vectors of planar lattices via continued fractions. Information Processing Letters, 2001, to appear.

http://www.mpi-sb.mpg.de/~eisen/report_lattice.ps.gz

4. C.F. Gauÿ. Disquisitiones arithmeticae. Gerh. Fleischer Iun., 1801. 5. C.F. Gauÿ. Recension der Untersuchungen über die Eigenschaften der positiven ternären quadratischen Formen von Ludwig August Seeber. Reprinted in Journal für die reine und angewandte Mathematik, 20:312320, 1840.

6. Ch. Hermite. Extraits de lettres de M. Ch. Hermite à M. Jacobi sur diérents objets de la théorie des nombres. Journal für die reine und angewandte Mathematik, 40, 1850. 7. J. C. Lagarias.

Worst-case complexity bounds for algorithms in the theory of

integral quadratic forms. Journal of Algorithms, 1:142186, 1980. 8. A.K. Lenstra, H.W. Lenstra, and L. Lovász. Factoring polynomials with rational coecients. Math. Annalen, 261:515534, 1982. 9. H.W. Lenstra. Integer programming with a xed number of variables. Mathematics of Operations Research, 8(4):538548, 1983.

10. A. Schönhage. Fast reduction and composition of binary quadratic forms. In International Symposium on Symbolic and Algebraic Computation, ISSAC'91, pages

128133. ACM Press, 1991. 11. A. Schönhage and V. Strassen. Schnelle Multiplikation grosser Zahlen (Fast multiplication of large numbers). Computing, 7:281292, 1971. 12. A. Schrijver. Theory of Linear and Integer Programming. John Wiley, 1986. 13. L.A. Seeber. Untersuchung über die Eigenschaften der positiven ternären quadratischen Formen. Loeer, Mannheim, 1831.

14. I. Semaev.

A 3-dimensional lattice reduction algorithm.

In Cryptography and

Lattices Conference, CALC 2001. This volume, pp. 181193, 2001.

15. B. Vallée. An ane point of view on minima nding in integer lattices of lower dimensions.

In Proceedings of the European Conference on Computer Algebra,

EUROCAL'87, volume 378 of Lecture Notes in Computer Science, pp. 376378.

Springer, Berlin, 1989. 16. C.K. Yap. Fast unimodular reduction: Planar integer lattices. In Proceedings of the 33rd Annual Symposium on Foundations of Computer Science, pages 437446,

Pittsburgh, 1992. IEEE Computer Society Press.

Factoring Polynomials and 0–1 Vectors Mark van Hoeij Department of Mathematics, Florida State University Tallahassee, FL 32306-3027 [email protected]

Abstract. A summary is given of an algorithm, published in [4], that uses lattice reduction to handle the combinatorial problem in the factoring algorithm of Zassenhaus. Contrary to Lenstra, Lenstra and Lov´ asz, the lattice reduction is not used to calculate coeﬃcients of a factor but is only used to solve the combinatorial problem, which is a problem with much smaller coeﬃcients and dimension. The factors are then constructed eﬃciently in the same way as in Zassenhaus’ algorithm.

1

Comparison of Three Factoring Algorithms

Let f ∈ Q[x] be a polynomial of degree N . Write f=

N

ai xi

with ai ∈ Q.

i=0

Suppose that f is monic (i.e. aN = 1) and square-free (i.e. gcd(f, f ) = 1). Assume that the coeﬃcients ai do not have more than D digits. Let p be a prime number and let Qp be the ﬁeld of p-adic numbers. Let f=

n

fi

i=1

where fi ∈ Qp [x] are the monic irreducible factors of f in Qp [x]. Let v be a 0–1 vector, i.e. v = (v1 . . . vn ) ∈ {0, 1}n. Let gv = fivi . Then {gv |v ∈ {0, 1}n} is the set of all monic factors of f in Qp [x]. Let V = {v ∈ {0, 1}n|gv ∈ Q[x]} so {gv |v ∈ V } is the set of all monic factors of f in Q[x]. Let B = {v ∈ V |gv irreducible in Q[x]}. Because Q[x] has unique factorization it follows that V is the set of all {0, 1}linear combinations of B. J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 45–50, 2001. c Springer-Verlag Berlin Heidelberg 2001

46

Mark van Hoeij

The algorithm of Zassenhaus [1] to factor f in Q[x] works as follows. First the fi are computed modulo a power of p using Hensel lifting. The computation time is bounded by PZ (N, D) which is a polynomial in N and D. Then, for v ∈ {0, 1}n, a method is given to decide if gv ∈ Q[x] or not, and if so, to calculate gv ∈ Q[x]. If gv is not in Q[x], then the time c to verity that is very small, and is almost independent of N and D. For all practical purposes we can assume that this cost c is constant. Calculating gv for all v ∈ B gives the set of all irreducible factors of f . But no method is given to calculate the set B, other than to try all v. Denote |v| = vi , so gv is a product of |v| p-adic factors. First one tries all v with |v| = 1, then |v| = 2, etc. Whenever a gv ∈ Q[x] is found, the corresponding fi are removed, and n decreases. The complexity depends on M = max{|v|, v ∈ B}. The worst case is M = n, i.e. f is irreducible, because then all 2n vectors v will be be tried (or 2n−1 vectors, by skipping the complements of the v’s that were already tried). So the total cost is at most PZ (N, D) + c2n−1 , where c is a very small constant. If M = n/2 then the cost is essentially the same. If M < n/2 then the cost is lower, we can bound the cost by PZ (N, D) + cEZ (n, M ), where EZ (n, M ) ≤ 2n−1 depends exponentially on M . After trying all |v| ≤ 3, which can be done quickly, we may assume that M > 3 (if there are still any fi left). In most examples (even with large N ) the number M will be small. Then PZ dominates the computation time and the algorithm works fast. However, in some examples M can be large, in which case cEZ can dominate the computation time. This happens when f has few factors in Q[x] but many factors in Qp [x] for every p. Such polynomials have a very special Galois group; order(σ) N for every σ in the Galois group. Extreme examples are the Swinnerton-Dyer polynomials, where order(σ) ≤ 2 for all σ. Other examples are resolvent polynomials, which tend to be polynomials of high degree with small Galois groups. For these polynomials, the computation time is dominated by cEZ , and the algorithm of Zassenhaus will be exponentially slow. The ﬁrst polynomial time algorithm was given by Lenstra, Lenstra and Lov´ asz. In their paper [2] they give a lattice reduction algorithm (the LLL algorithm). Many combinatorial problems can be solved in polynomial time with LLL by encoding the solutions of the problem as short vectors in a lattice. The LLL algorithm can ﬁnd the set S of short vectors, provided that all vectors outside of span(S) are suﬃciently long in comparison. In [2] the LLL algorithm is used in the following way. Take one factor f1 ∈ Qp [x] of f . The problem to be solved with LLL is: Find, if it exists, a non-zero g ∈ Q[x] of degree < N such that f1 divides g. If such g exists, then gcd(f, g) ∈ Q[x]

Factoring Polynomials and 0–1 Vectors

47

is a non-trivial factor of f . This problem is reduced to lattice reduction as follows. First calculate f1 modulo a suﬃciently high power of p by Hensel lifting. The cost of Hensel lifting can be bounded by PL1 (N, D) which is a polynomial in N, D. From that, a lattice can be constructed that (if f is reducible) contains a vector Ug whose entries are the coeﬃcients of g. Then the LLL algorithm can ﬁnd this vector in a time bounded by PL2 (N, D) which is also a polynomial in N and D. So the total computation time is bounded by PL = PL1 + PL2 , which is a polynomial in N, D. However, PL1 > PZ because one must Hensel lift up to a substantially higher power of p. Furthermore, PL2 PZ , in other words, the algorithm of Zassenhaus is much faster, except when cEZ PZ which only happens for polynomials with special Galois groups. So, there exists a polynomial time algorithm [2], and an exponential time algorithm [1] that is faster most of the time (except when M is large). How can the advantages of both algorithms be combined? Suppose that gv ∈ Q[x]. The algorithm in [2] would ﬁnd such g = gv by computing a vector Ug in an N -dimensional lattice whose entries are the coefﬁcients of g. Suppose that g is large (say degree ﬁve hundred and coeﬃcients with thousands of digits). Lattice reduction is a very general method that can be applied to solve many combinatorial problems. So it is to be expected that if it is used to construct a large expression such as Ug that it will take a long time. To have a faster computation, we must use LLL to construct smaller vectors instead. The vectors in B are much smaller than the vector Ug , in two ways. The entries have only 1 digit whereas the entries of Ug can have many digits. And the number of entries is only n, usually n is much smaller than N (except for Swinnerton-Dyer polynomials where n = N/2, which is smaller but not much smaller than N ). Because of the much smaller size, LLL can calculate the elements of B much faster than the vector Ug . We need to design an input lattice for LLL in such a way, that span(B) and hence B can be obtained from the short vectors found by LLL. To keep the LLL cost to a minimum, we must make sure that the short vectors found by LLL do not contain any information (other than the set B) about the coeﬃcients of a factor g, so that the LLL cost will not depend on the size of g. The LLL cost will then be bounded by a polynomial P (n) that depends only on n, and not on N or D. The cost cEZ (n, M ) of ﬁnding the set B in Zassenhaus’ algorithm is now replaced by P (n), and the total cost of factoring is now: PZ (N, D) + P (n). So the resulting algorithm is faster than Zassenhaus’ algorithm whenever P (n) < cEZ (n, M ). It turns out in experiments that the cut-oﬀ point is low. That means that when P (n) is not smaller than cEZ (n, M ), then P (n) and cEZ (n, M ) are both small, so then the computation time is close to PZ (N, D) for both algorithms. However, when n is larger, then P (n) can be much smaller than cEZ (n, M ). Experiments

48

Mark van Hoeij

show that polynomials with n > 400, N, D > 2000 can be handled, which is far beyond the reach of [1,2].

2

How to Construct the Lattice to Find B?

To ﬁnd linear conditions on v we can not use the coeﬃcients of the polynomial gv , because they do not depend linearly on v, gu+v = gu gv . In order to ﬁnd linear conditions, a vector TA (g) with s entries (s will be small compared to n) will be deﬁned, that has the following property: TA (g1 g2 ) = TA (g1 ) + TA (g2 ) ∈ Qsp

for all non-zero g1 , g2 ∈ Qp [x].

This TA (g) will be constructed in such a way that the entries of TA (gv ) are p-adic integers for all 0–1 vectors v, and if furthermore gv ∈ Q[x] then the entries are 1 b integers, bounded in absolute value by 2 p for some integer b. Now TA (gv ) = vi TA (fi ) is a linear combination of the TA (fi ), and when gv ∈ Q[x] then the entries of this linear combination are integers. However, the entries of TA (fi ) are not yet suitable for use in the LLL input vectors for two reasons. First, these entries of TA (fi ) are p-adic integers, which are not ﬁnite expressions. Second, if gv ∈ Q[x], then the entries of TA (gv ) are integers bounded by 12 pb , and these integers give some partial information about the coeﬃcients of gv . It would be ineﬃcient to have this information in the lattice. Both problems are solved by cutting each entry of TA (fi ) on two sides. If t is such an entry, then the p-adic integer t can be written as t=

∞

ti p i

with ti integers and −

i=0

p p < ti ≤ . 2 2

Choose a > b, then cut such t by replacing it with a−1

ti pi−b .

i=b

So the powers ≥ a and the powers < b of p in t are removed. The ﬁrst causes the expression to be ﬁnite, and the second removes unnecessary information about the coeﬃcients of g from the lattice. Denote the result of this cutting by TAb,a (fi ). Let e1 , . . . , en be the standard basis vectors, so gei = fi . Denote Vi = (ei , TAb,a (fi )) as the concatenation of the vectors ei and TAb,a (fi ). The number of entries is n + s which is a little more than n. Denote Ej , j ∈ {1, . . . , s} as the vector with n + s entries, all 0 except for the n + j’th entry which is pa−b . The n + s vectors Vi and Ej are now the input vectors for LLL. To ﬁnd the set B, calculate the short vectors in the lattice spanned by the Vi and Ej , then take the projection on the ﬁrst n entries, and then reduce those vectors

Factoring Polynomials and 0–1 Vectors

49

to echelon form. The resulting vectors form the set B, provided that a, b and the other parameters in the algorithm were set properly. This can be veriﬁed; the polynomials gv for v in the calculated set B are automatically irreducible if they are in Q[x], so to verify the correctness of B one only needs to check that gv ∈ Q[x] for all v ∈ B. The reason that the LLL algorithm lets us ﬁnd the vectors v for which gv ∈ Q[x] is because for those v, the entries of TA (gv ) are integers bounded by 12 pb , hence TAb,a (gv ) = 0. Now vi TAb,a (fi ) is almost the same as TAb,a (gv ) = 0, except for some round-oﬀ errors (caused by cutting the p-adic numbers) which must be of the form 1 + 2 pa−b , where 1 , 2 are small. The vector vi TAb,a (fi )) vi Vi = (v, is in the lattice. After reducing with the vectors Ei , all entries are small; the ﬁrst n entries are all 0 or 1, and the last s entries are small as well. So vi Vi is a short vector. When this vector is found by LLL, v can be read oﬀ by taking the ﬁrst n entries. There is a lot of freedom in the choice of the numbers pa−b and s so one can choose the size of the LLL input vectors. For eﬃciency, the size should be not too large, but the size should also not be too small because LLL can only ﬁnd the short vectors if the remaining vectors are suﬃciently long in comparison. The number s(a − b)log(p) should be O(n2 ), and should be independent of N and D.

3

The i’th Trace

Definition 1. The i’th trace Tri (g) of a polynomial g is defined as the sum of the i’th powers of the roots (counted with multiplicity) of g. It is clear that Tri (f1 ) + Tri (f2 ) = Tri (f1 f2 ) i for any two polynomials f1 , f2 . Suppose g = ci x is monic of degree d. Then Tri (g) for i = 1, . . . , k can be determined from cd−i for i = 1, . . . , k with the Newton relations, and vice versa. Now choose some i1 , i2 , . . . , is , and for g ∈ Qp [x] let TA (g) be a vector whose entries are the p-adic numbers Tri1 (g), . . . , Tris (g) multiplied by some integer m. The integer m is chosen in such a way that if g is a factor of f in Q[x], then the entries of TA (g) are integers. If f is monic and has integer coeﬃcients then m = 1. The number s is normally chosen much smaller than n or degree(g), so TA (g) will only contain partial information about the coeﬃcients of g. By computing a bound for the absolute value of the complex roots of f , it is easy to bound

50

Mark van Hoeij

Tri (g) for any factor g ∈ Q[x] of f , so it is easy to calculate a number b such that the absolute values of the entries of TA (g) are bounded by 12 pb . We use TA (g) to ﬁx the problem that gv does not depend linearly on v. There is also another way to ﬁx this problem: In [3] Victor Miller uses idempotents to factor in Q[x]. The main diﬀerence with our algorithm is that our algorithm is closer to Zassenhaus’ algorithm, because only the 0–1 vectors are computed with integer-relation-ﬁnding or LLL; the factors g themselves are constructed like in [1]. Millers algorithm is less similar to [1] but is closer to [2] in the sense that everything is computed with integer-relation-ﬁnding, more precisely: it calculates the 0–1 vector and the idempotent e simultaneously, and if e is a non-trivial idempotent then gcd(e, f ) ∈ Q[x] is a non-trivial factor of f . In our algorithm, besides the 0–1 vector, no information about g is calculated with LLL, because the value of TA (g) which contains information about g is precisely what is being cut away when all powers < b of p were removed.

References 1. H. Zassenhaus, On Hensel Factorization, I., Journal of Number Theory 1, 291–311 (1969). 2. A.K. Lenstra, H.W. Lenstra and L. Lov´ asz, Factoring polynomials with rational coeﬃcients, Math. Ann. 261, 515–534 (1982). 3. V. Miller, Factoring polynomials via Relation-Finding. ISTCS’92, Springer Lecture Notes in Computer Science 601, 115–121 (1992). 4. M. van Hoeij, Factoring polynomials and the knapsack problem, preprint available from http://www.math.fsu.edu/~hoeij/ accepted for Journal of Number Theory (2000).

Approximate Integer Common Divisors Nick Howgrave-Graham IBM T.J.Watson Research Center PO Box 704, Yorktown Heights, New York 10598, USA [email protected]

Abstract. We show that recent results of Coppersmith, Boneh, Durfee and Howgrave-Graham actually apply in the more general setting of (partially) approximate common divisors. This leads us to consider the question of “fully” approximate common divisors, i.e. where both integers are only known by approximations. We explain the lattice techniques in both the partial and general cases. As an application of the partial approximate common divisor algorithm we show that a cryptosystem proposed by Okamoto actually leaks the private information directly from the public information in polynomial time. In contrast to the partial setting, our technique with respect to the general setting can only be considered heuristic, since we encounter the same “proof of algebraic independence” problem as a subset of the above authors have in previous papers. This problem is generally considered a (hard) problem in lattice theory, since in our case, as in previous cases, the method still works extremely reliably in practice; indeed no counter examples have been obtained. The results in both the partial and general settings are far stronger than might be supposed from a continued-fraction standpoint (the way in which the problems were attacked in the past), and the determinant calculations admit a reasonably neat analysis. Keywords: Greatest common divisor, approximations, Coppersmith’s method, continued fractions, lattice attacks.

1

Introduction

When given new mathematical techniques, as is the case in [1] and [5], it is important to know the full extent to which the result can be used, mathematically, even if this generalisation does not have immediate applications (to cryptography, say). In this paper we will start by describing approximate common divisor problems. Later we will show that the above results can be seen as special instances of this problem, and we will describe a lattice based solution to (a version of) the general problem. For now let us just concentrate on explaining approximate common divisor problems. As an example, we explain this in the more speciﬁc and familiar case of greatest common divisors. If we are given two integers a and b we can clearly ﬁnd their gcd, d say, in polynomial time. If d is in some sense large then it may be possible to incur some additive “error” on either of the inputs a and b, or both, and still recover this gcd. This is what we refer to as an approximate common J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 51–66, 2001. c Springer-Verlag Berlin Heidelberg 2001

52

Nick Howgrave-Graham

divisor problem (ACDP); although we delay its rigorous deﬁnition to later. Of course if there is too much error incurred on the inputs, the algorithm may well not be able to discern the gcd d we had initially over some other approximate divisors d (e.g. they may all leave residues of similar magnitude when dividing a and b). In this sense, the problem is similar to those found in error correcting codes. Continuing this error correcting code analogy we can state the problem from the standpoint of the design of the decoding algorithm, i.e. we wish to create an algorithm which is given two inputs a0 and b0 , and bounds X, Y and M for which one is assured that d|(a0 + x0 ) and d|(b0 + y0 ) for some d > M and x0 , y0 satisfying |x0 | ≤ X, |y0 | ≤ Y . The output of the algorithm should be the common divisor d, or all of the possible ones if more than one exists. We explore the following questions: under what conditions on these variables and bounds – is d uniquely deﬁned, or more generally limited to polynomially many solutions? – does an algorithm exist to recover these d in polynomial time? Without loss of generality let us assume that our inputs are ordered so that X ≥ Y . If one of the inputs is known exactly, i.e. Y = 0, then we call this a partially approximate common divisor problem (PACDP), and we refer to an algorithm for its solution as a PACDP algorithm. If however neither input is known exactly, i.e. Y > 0, then we refer to the problem as a general approximate common divisor problem (GACDP), and an algorithm for its solution is called a GACDP algorithm. In section 3 we show that the results given in [1] and [5] may be seen as special instances of a PACDP, and the techniques used therein eﬀectively give a PACDP algorithm. As a motivating example of this, consider the √ widely appreciated result in [1], which states that if N = pq where p ∼ q ∼ N , and we are given the top half of the bits of p then one can recover the bottom half of the bits of p in polynomial time. Notice that in eﬀect we are given p0 , such that p0 = p + x0 , for some x0 satisfying |x0 | < N 1/4 , from which we can recover the whole of p. It is not so widely known that the result also holds if we are given any integer p0 such that p0 = kp + x0 for some integer k (and the same bound on x0 as before), i.e. we can still recover all the bits of p from this information too. This immediately shows that Okamoto’s cryptosystem [11] leaks the private information (the factorisation of n = p2 q) from the public information (n and √ u = a + bpq where a < (1/2) pq) in polynomial time1 , so this result can be considered an even stonger break than that given in [14], which recovers all plaintexts, but does not recover the secret information. In section 4 we go on to consider the GACDP, and produce some new and interesting bounds for polynomial time algorithms which (heuristically) solve this. For ease of analysis we do restrict our attention to the case when a0 ∼ b0 1

In fact the size of a is much smaller than it need be for this attack to work.

Approximate Integer Common Divisors

53

and X ∼ Y (we call such input “equi-sized”), though similar techniques can brought to bear in more general situations. This general problem is thought to be very interesting to study from a mathematical point of view, and the lattice analysis is also considered to be quite neat and interesting from a theoretical standpoint, however this generalisation admittedly lacks an obvious (useful) application in either cryptography or coding theory. It is hoped that with this presentation of the problem, a use will subsequently be found. In section 7 we conclude with some open and fundamental questions associated with these general lattice techniques. 1.1

Presentation and Algorithm Definitions

In the remainder of this paper a and b will always denote integers which do have a “large” common divisor, and d will be used to represent this common divisor. The (known) approximations to a and b will be denoted by a0 and b0 respectively, and their diﬀerences by x0 = a − a0 , y0 = y − y0 . A real number α ∈ (0 . . . 1) is used to indicate the quantity logb d, and α0 is used to indicate a (known) lower bound for this quantity. Given two integers u, v we will write u ∼ε0 v if | log2 log2 u − log2 log2 v| < ε0 , though we frequently drop the ε0 subscript, when it is clear what we mean. We now deﬁne the algorithms to solve the ACDPs presented in this paper. We include their bound information to fully specify the algorithms, though the proof of these bounds, and the proof that their output is polynomially bounded, is left to their respective sections. We start with the PACDP algorithms described in sections 2 and 3. Algorithm 11. The (continued fraction based) partially approximate common divisor algorithm PACD CF, is defined thus: Its input is two integers a0 , b0 such that a0 < b0 . The algorithm should output all integers d = bα 0 , α > 1/2, such that there exists an x0 with |x0 | < X = b2α−1 , and d divides both a0 + x0 and b0 , 0 or report that no such d exists (under the condition on X we are assured that there are only polynomially many solutions for d). Algorithm 12. The (lattice based) partially approximate common divisor algorithm PACD L, is defined thus: Its input is two integers a0 , b0 , a0 < b0 and β0 0 two real numbers ε, α0 ∈ (0 . . . 1). Let us define M = bα 0 and X = b0 where 2 β0 = α0 − ε. The algorithm should output all integers d > M such that there exists an x0 with |x0 | < X, and d divides both a0 + x0 and b0 , or report that no such d exists (under the conditions on M and X we are assured that there are only polynomially many solutions for d). Firstly notice that the condition a0 < b0 is not a limitation at all. Since we know b0 exactly we may subtract any multiple of it from a0 to ensure this. Secondly (and far more importantly) notice that there is a subtle distinction between algorithms 11 and 12 in that in the continued fraction based algorithm

54

Nick Howgrave-Graham

α is not an input, but rather is deﬁned in terms of any common divisor d (this is true of the GACDP algorithms deﬁned below too). This is preferential to the situation with the lattice algorithms, in which it is presently necessary to state in advance an α0 < α, and then the bound X is deﬁned in terms of α0 rather than α (so one would wish α0 to be very close to α to ensure X was as large as possible). Thirdly notice the requirement for α > 1/2 in the continued fraction techniques. A major contribution of this paper is in showing that we may solve the ACDPs for α < 1/2 too, using the lattice based methods. Lastly notice the appearance of ε in the lattice based variants. This is because the bound on X in these algorithms is deﬁned asymptotically. In order to know X explicitly we allow ε logb0 X to be given as input to the algorithm. We give two equi-sized (i.e. a0 ∼ b0 ) GACDP algorithms in the paper, one in section 2 and one in section 4. The lattice based approach is only deﬁned for α < 2/3. Refer to ﬁgure 61 to see a graphical representation of the bounds from each of the algorithms. Algorithm 13. The (continued fraction based) equi-sized GACDP algorithm GACD CF, is defined thus: Its input is two integers a0 , b0 subject to a0 ∼ b0 , a0 < b0 . The algorithm should output all integers d = bα 0 , α > 1/2 such that there exist integers x0 , y0 with |x0 |, |y0 | < X = bβ0 where β = max(2α − 1, 1 − α), and d divides both a0 + x0 and b0 + y0 , or report that no such d exists (under the condition on X we are assured that there are only polynomially many solutions for d). Algorithm 14. The (lattice based) equi-sized GACDP algorithm GACD L, is defined thus: Its input is two integers a0 , b0 subject to a0 ∼ b0 , a0 < b0 , and β0 0 two real numbers ε, α0∈ (0 . . . 2/3). Let us define M = bα 0 and X = b0 where β0 = 1 − (1/2)α0 − 1 − α0 − (1/2)α20 − ε. The algorithm should output all integers d > M such that there exist integers x0 , y0 with |x0 |, |y0 | < X, and d divides both a0 + x0 and b0 + y0 , or report that it is unlikely that such a d exists (under the conditions on M and X we are assured that there are only polynomially many solutions for d). As the above deﬁnitions mention, the number of common divisors d is polynomially bounded when the conditions of the algorithms are met. If one wishes to use the algorithms as encoding/decoding algorithms, and so require a unique output from the algorithms, then one should ensure that the “aimed for” solution is substantially below the algorithm bounds, meaning that it is highly (exponentially) unlikely that any of the other (polynomially many) common divisors will be confused with it. Notice that since algorithm GACD L is heuristic, it is possible that a d exists which meets the conditions of the algorithm, but it is not found. In order to give an indication of the probability of this event happening one can refer to the results in Table 1. As can be seen there, no such occurances were detected, and so such events are considered to be extremely rare.

Approximate Integer Common Divisors

2

55

A Continued Fraction Approach

One way to approach solving the ACDPs is to consider the sensitivity of the Euclidean algorithm to additive error of its inputs. This can be studied via the use of coninued fractions, as explained in [6]. One of the many places such an analysis was found useful was in [15], when attacking RSA with a small decrypting exponent, and we look at this further in section 5. The main results that are useful in this analysis are the following: Theorem 21. Let ρ be any real number, and let gi /hi , i = 1 . . . m denote the (poynomially many) approximants to ρ during the continued fraction approximation. For all i = 1 . . . m we have that ρ − gi < 1 . hi h2i Moreover for every pair of integers s, t such that s 1 ρ − < 2 t 2t then the ratio s/t will occur as one of the approximants gj /hj for some j ∈ (1 . . . m). To see how this applies to creating an ACDP algorithm, let us recall the input to the continued fraction based algorithms, namely two integers a0 and b0 , a0 < b0 , and we search for common divisors d = bα 0 that divide both a0 + x0 and b0 + y0 (y0 = 0 in the PACDP). In this section we will assume that x0 and y0 are such that |x0 |, |y0 | < bβ0 , and show the dependence of β on α so that the continued fraction approach is assured of ﬁnding the common divisors d. We will see that the basic algorithm is essentially the same for PACD CF and GACD CF, i.e. the fact that we know y0 = 0 will only help limit the number of d, not the approach used to ﬁnd them. Let a and b denote (a0 + x0 )/d and (b0 + y0 )/d respectively, so clearly the sizes of a and b are bounded by |a |, |b | < b1−α . Also notice that 0 a a0 + x0 a0 y0 − b0 x0 a0 y0 − b0 x0 a0 = + = + b0 b0 + y0 b0 (b0 + y0 ) b b0 (b0 + y0 ) so we have

a0 − a = |a0 y0 − b0 x0 | < bβ−1 0 b0 b b0 (b0 + y0 )

This means that by producing the continued fraction approximation of ρ = < 1/(2(b )2 ). Since we are primarily a0 /b0 , we will obtain a /b whenever bβ−1 0 concerned with large a0 and b0 we choose to ignore constant terms like 2, and by using the fact that |b | < b1−α we see that this inequality holds whenever 0 β − 1 < 2(α − 1), or β < 2α − 1 as anticipated by the algorithm deﬁnitions.

56

Nick Howgrave-Graham

Thus for both PACD CF and GACD CF the algorithm essentially comes down to calculating the continued fractions approximation of a0 /b0 ; the only diﬀerence between these two algorithms is what is then outputted as the common divisors d. Let us ﬁrst concentrate on PACD CF, and let gi /hi denote the (polynomially many) approximants in the continued fraction approximation of a0 /b0 . If d = bα 0 divides both a0 + x0 and b0 and |x0 | < X = b2α−1 we know a0 /b0 is one of 0 these approximants. It remains to test each of them to see if hi divides b0 ; if it does then we output d = b0 /hi as a common divisor. Note that for all such . approximants we are assured that |x0 | < X since x0 = a0 − dg < b0 /h2 = b2α−1 0 This proves the existence of algorithm PACD CF. We now turn our attention to algorithm GACD CF. The ﬁrst stage is exactly the same, i.e. we again consider the (polynomially many) approximants gi /hi , however now hi need not divide b0 . Instead we ﬁnd the integer k (which will correspond to our common divisor d) which minimises the max-norm of the vector k(gi , hi ) − (a0 , b0 ) = (x0 , y0 ). Again we are assured that for all approximants |x0 |, |y0 | < X = b2α−1 . 0 However consider (x0 , y0 ) = (k + l)(gi , hi ) − (a0 , b0 ) = (x0 , y0 ) + l(gi , hi ) for some integer l. If it is the case that |lgi |, |lhi | < X as well, then this will mean (k + i) for all i = 0 . . . l satisfy the properties of the common divisors d, and shoud be outputted by the algorithm. Since hi = b1−α there are b3α−2 choices 0 0 for l, which becomes exponential for α > 2/3. In order to limit ourselves to polynomially many d we deﬁne X = bβ0 where β = min(2α − 1, 1 − α), which ensures there is (exactly) one common divisor d associated with each continued fraction approximant gi /hi . This proves the existence of algorithm GACD CF. Readers who are reminded of Wiener’s attack on RSA by this analysis should consult section 5. Even though it is known that the continued fraction analysis is optimal for the Euclidean algorithm, we do obtain better bounds for the PACDP and the GACDP in the next sections. This is because we are not restricted to using the Euclidean algorithm to ﬁnd the common divisors d, but rather we can make use of higher dimensional lattices, as originally done in [1].

3

Using Lattices to Solve PACDP

Essentially there is nothing new to do in this section, except point out that the techniques previously used to solve divisibility problems, e.g. [1] and [5], actually apply to the more general case of PACDPs. To do this we will concentrate on the approach taken in [5] (because of the simpler analysis), which we sum up brieﬂy below (primarily so that we can draw similarities with the method described in section 4). The reader is encouraged to consult the original paper for complete details of this method. The algorithm was originally used to factor integers of the form N = pr q. In this section we will restrict our attention to r = 1, though we note that the

Approximate Integer Common Divisors

57

techniques still work for larger r (which would be analagous to ACDPs such that one of the inputs is near a power of the common divisor d). A key observation in [5] is that if we have m polynomials pi (x) ∈ Z[x], and we are assured that for some integer x0 we have pi (x0 ) = 0 mod t for all i = 1 . . . m, then any (polynomial) linear combination of these polynomials, i.e. m r(x) = i=1 ui (x)pi (x) also has the property that r(x0 ) = 0 mod t. The trick is to ﬁnd a polynomial r(x) of this form, which is “small” when evaluated at all the “small” integers. Let r(x) = r0 + r1 x + . . . + rh xh . One way to ensure that |r(x)| ≤ hX h when evaluated at any x such that |x| < X is to make the ri satisfy |ri |X i ≤ X h . This is the approach we shall take, and we shall use lattice reduction algorithms to generate these coeﬃcients. Notice that if t were such that t > hX h and x0 were such that |x0 | < X, then the integer r(x0 ) which must be a multiple of t, but cannot be as large as t, must therefore equal 0. By ﬁnding all the roots of the equation r(x) = 0 over the integers we therefore ﬁnd all possible x0 for which the pi (x0 ) = 0 mod t when |x0 | < (t/h)1/h . To see the relevance of this with the PACDP, notice that in the PACDP we are eﬀectively given two polynomials2 q1 (x) = a0 + x and q2 (x) = b0 , and told β0 0 that d > M = bα 0 divides both q1 (x0 ) and q2 (x0 ) for some |x0 | < X = b0 . As in the previous section we will work out the conditions on β0 (in terms of α0 ) for us to be assured of ﬁnding such common divisors d. Rather than just consider q1 (x) and q2 (x) directly we will calculate r(x) by considering the polynomials pi (x) = q1 (x)u−i q2 (x)i for some ﬁxed integer u and i = 0 . . . u. Let h be the degree of the polynomial r(x) we are trying to produce. We will see later how the optimal choice of h is related to u, but for the moment just notice that pi (x0 ) = 0 mod du for i = 0 . . . u. In order to ﬁnd the desired polynomial r(x) and to work out the size of its coeﬃcients we must describe the lattice we build. To this end we show an example below with h = 4 and u = 2. 

0 0 0 b20  b 0 a0 b 0 X 0 0  2  a0 2a0 X X 2 0   0 a20 X 2a0 X 2 X 3 0 0 a20 X 2 2a0 X 3

 0 0   0   0  X4

The reason that we build the lattice generated by the rows of this type of matrix, is that each of the ﬁrst u + 1 rows corresponds to one of the polynomials pi (x), where the coeﬃcient of xj is placed into the (j + 1)th column multiplied 0 with X j = bjβ 0 . Notice that with this representation the integer matrix operations respect polynomial addition. The remaining h−u−1 rows eﬀectively allow for a polynomial multiple of the relation (a0 +x)u (polynomial multiples of the other relations are ignored because 2

Notice that q2 (x) is simply a constant, but we still refer to it as a (constant) polynomial.

58

Nick Howgrave-Graham

of their obvious linear dependence). If these choices seem a little “plucked from the air”, their justiﬁcation can be seen in the determinant analysis. We plan to reduce this lattice to obtain a small r = (r0 , r1 X, . . . , rh X h ) vector i from which we obtain the polynomial r(x) = ri x . It remains to see how small the entries of r will be. The dimension of the lattice is clearly (h + 1) and the determinant of the lattice can be seen to be u(u+1)/2

∆ = X h(h+1)/2 b0

u(u+1)/2+β0 h(h+1)/2

= b0

,

which means we are assured of ﬁnding a vector r such that |r| < c∆1/(h+1) for some c which (as in the previous section) is asymptotically small enough (compared to ∆1/(h+1) ) for us to ignore in the following analysis. To actually ﬁnd r one would use the LLL algorithm (see [8]) or one of its variants (e.g. [12]). Notice that, as mentioed above, this bound (approximately) a oni r is also ri x , and x is any integer such bound on the integers |r(x )|, where r(x) = that |x | < X. 0u We therefore wish ∆1/(h+1) to be less than du > bα 0 , so that the roots of 0 r(x) = 0 over the integers must contain all solutions x0 such that d > bα 0 divides both q1 (x0 ) and q2 (x0 ), and |x0 | < X. For this to happen we require that (u(u + 1) + β0 h(h + 1))/(2(h + 1)) < α0 u, i.e. u(2(h + 1)α0 − (u + 1)) . β0 < h(h + 1) For a given α0 the optimum choice of h turns out to be at approximately u/α0 ; in which case we obtain that whenever β0 < α20 −

α0 (1 − α0 ) , h+1

we will ﬁnd all the possible x0 . This proves the existence of algorithm GACD L. One simply reduces the relevant lattice with h = (α0 (1 − α0 )/ε − 1 and u = hα0 , and ﬁnds the roots of the resulting polyomial equation over the integers. The fact that there are only a polynomial number of possible d follows from the fact that the number of x0 is bounded by h.

4

Using Lattices to Solve GACDP

In this section we attempt to solve GACDP by recovering the x and y such that “a paricularly large” d divides both a0 + x and b0 + y. As mentioned in section 2 2/3 there are exponentially many x and y for d > b0 which implies that our lattice technique cannot work above this bound. However we will show that the method does work (heuristically) right up to this bound. The approach taken is similar to that described in section 3, which we will make frequent reference to, but the analysis must now deal with bivariate polynomials.

Approximate Integer Common Divisors

59

A particularly interesting question is whether one can make what follows completely rigorous. Such an argument is presently evading author, and as shown in [9] one cannot hope for a argument for a general bivariate modular equation, but it does not rule out that in in this case (and other speciﬁc cases) it may be possible to prove what follows. In the GACDP we are given two polynomials3 q1 (x, y) = a0 +x and q2 (x, y) = b0 + y, where a0 ∼ b0 , and told that d > M = bα 0 divides q1 (x0 , y0 ) and q2 (x0 , y0 ) for some |x0 |, |y0 | < X = bβ0 . The ﬁrst thing to notice is that we can extend the general approach of the last section easily, since if we have m polynomials pi (x, y) ∈ Z[x, y], and we are assured that for some integers x0 , y0 we have pi (x0 , y0 ) = 0 mod t for all i = 1 . . . m, then any (polynomial) linear combination of these polynomials, i.e. r(x, y) = m i=1 ui (x, y)pi (x, y) also has the property that r(x0 , y0 ) = 0 mod t. Again rather than just considering q1 (x, y) and q2 (x, y) directly we will calculate r(x, y) by considering the polynomials pi (x, y) = q1 (x, y)u−i q2 (x, y)i for some ﬁxed integer u. In this new case the role of the variable h is as a bound on the total degree of the polynomials. Notice that we still have pi (x0 , y0 ) = 0 mod du . As an example of the lattice we create we show below the matrix whose rows generate the lattice, for h = 4 and u = 2. Note that we use the symbol Y to denote bound on |y0 |, though in fact Y = X = bβ0 0 in our case (this is done so that the entries of the matrix may be more easily understood).           

2a0 X X2 0 0 0 0 0 0 0 0 0 0 0 0 2a0 X 2 X3 0 0 0 0 0 0 0 0 0 0 0 a2 X 0 0 0 a2 X 2 2a0 X 3 X 4 0 0 0 0 0 0 0 0 0 0 0 a0 b0 b0 X 0 0 0 a0 Y XY 0 0 0 0 0 0 0 0 2 2 0 a0 b0 X b0 X 0 0 0 a0 XY X Y 0 0 0 0 0 0 0 0 0 a0 b0 X 2 b0 X 3 0 0 0 a0 X 2 Y X 3 Y 0 0 0 0 0 0 b2 0 0 0 0 2b0 Y 0 0 0 Y2 0 0 0 0 0 0 0 0 0 0 2b0 XY 0 0 0 XY 2 0 0 0 0 0 b2 X 0 0 0 b2 X 2 0 0 0 0 2b0 X 2 Y 0 0 0 X2 Y 2 0 0 0 0 0 0 0 0 0 b2 Y 0 0 0 2b0 Y 2 0 0 Y3 0 0 0 0 0 0 0 0 0 b2 XY 0 0 0 2b0 XY 2 0 0 XY 3 0 0 0 0 2b0 Y 3 0 Y4 0 0 0 0 0 0 0 0 0 b2 Y 2 0 a2 0 0

          

Again, since we are proving the bounds given in algorithm GACD L, we must treat β0 as a variable for the time being. As can be seen the situation is slightly diﬀerent to that previously obtained in section 3, mainly due to the diﬀerences in the linear dependencies of polynomial multiples of the pi (x, y). As we see we can multiply each pi (x, y) by xj for all j = 0 . . . h − u now, without incurring any linear dependencies. The down side is that only (h − u)(h − u + 1)/2 other rows corresponding to multiples of (b0 + y)u may be added. Alternatively seen, one can think of the pi (x, y) as (a0 + x)s (b0 + y)t for u ≤ s + t ≤ h, since these generate the same basis as the above ones. We consider these because they admit an easier analysis, though in practice we would probably reduce the above ones because they are slightly more orthogonal. 3

Notice that q1 (x, y) is not dependent on y, and q2 (x, y) is not dependent on x, but we cannot keep the univariate nature of them for long.

60

Nick Howgrave-Graham

Again we wish to reduce this lattice, and recover a polynomial r1 (x, y) which is small for all |x|, |y| < X. However knowing that all the x, y solutions to the GACDP are solutions to r1 (x, y) = 0 does not assure us of ﬁnding the x0 , y0 we require; in general we cannot solve a bivariate equation over the integers. The common (heuristic) argument at this stage, is to ﬁnd another small vector in the basis, from which one produces another polynomial r2 (x, y) = 0 over the integers. If we are fortunate in that r1 (x, y) and r2 (x, y) are algebraically independent, then this does give us enough information to solve for all roots (x, y), e.g. using resultant techniques. Unfortunately we cannot prove that in general we can always ﬁnd two small vectors which give rise to algebraically independent polyomials, although this would seem likely, and indeed is borne out by practical results (see Table 1). Assuming that we can ﬁnd two algebraically independent polynomials, we still have the problem of working out what bounds this lattice method implies. Working out the determinant of a lattice given by a non-square matrix can be a major piece of work; see for example [3]. Fortunately there is a trick in our example, which may prove useful in more general situations. It is well known that the determinant of the lattice is bounded above by the product of all the norms of the rows. Our strategy for analysing the determinant of this lattice will be to perform some non-integral row operations4 and then use the product of the norms of the rows. As an example of this if we consider the fourth row of the above lattice, then this clearly corresponds to the polynomial (a0 + x)(b0 + y). By writing (b0 + y) as y0 − (b0 /a0 )x + (b0 /a0 )(a0 + x) we see that (a0 + x)(b0 + y) = (a0 + x)(y −

a0 a0 x) + (n + x)2 . b0 b0

This means that taking a0 /b0 times the ﬁrst row, away from the fourth row, will leave us with a polynomial representing (a0 + x)(y − (a0 /b0 )x). Since a0 ∼ b0 , if we look at each of the entries of the vector corresponding to this polynomial then we see that they are each less than b0 X (since a0 < b0 ), so this a bound for the norm of the vector too (again we ignore the aymptotically small factor of the diﬀerence of these two norms). This bound is a vast improvement on the b20 we may have na¨ıvely bounded the vector by. In a similar way, we also see that the norms of the vectors corresponding to the polynomials (a0 + x)s can be bounded by X s−u bu0 , since we can subtract suitable multiples of the vectors corresponding to the polynomials (a0 + x)i for i < s. In general the vector corresponding to a polynomial pi (x, y) = (a0 + x)s (b0 + t for 0 ≤ t ≤ u and X s Y t for u < t ≤ h. We y) will contribute X s+t−u Y t bu−t 0 can write the contribution of the polynomials in a table indexed by s and t, e.g. for the above example with h = 4 and u = 2 4

These non-integral row operations will mean that the resulting matrix will no longer be a basis for our lattice, but it will have the same determinant which is all we care about estimating.

Approximate Integer Common Divisors

61

Y4 Y 3 XY 3 Y 2 XY 2 X 2 Y 2 b0 Y b0 XY b0 X 2 Y b20 b20 X b20 X 2 This representation allows us to count the dimension of the lattice and its determinant easily. The dimension is clearly m = (h + 1 − u)(h + u + 2)/2, and the determinant is u(u+1)(h+1−u)/2

∆ = Y (h+1−u)(h(h+u+2)+u(u+1))/6 b0

X (h−u)(h+1−u)(h+2u+2)/6 = bδ0

where δ = u(u + 1)(h + 1 − u)/2 + β0 (h + 1 − u)(2h2 + 4h + 2uh − u2 − u)/6. As in section 3 we require that δ < muα0 , so that the vectors LLL ﬁnds5 will be valid over the integers. Representing this in terms of β0 we obtain 3u(h + u + 2)α0 − 3u(u + 1) 2h(h + u + 2) − u(u + 1) 3u(h + u)α0 − 3u2 3u(h − u)(2h − uα0 ) . = − 2h(h + u) − u2 (2h(h + u) − u2 )(2h(h + u + 2) − u(u + 1))

β0 <

The optimal setting for γ such that h = u/γ is now 2 − 2α0 − 4 − 4α0 − 2α20 γ= 3α0 − 2 for which we obtain the bound 1 β0 < 1 − α0 − 2

1 1 − α0 − α20 − ε(h, α0 ) 2

where for completeness we give the precise ε(h, α0 ) = ε1 /ε2 ; namely ε1 = 3(3α0 − 2) (α0 − 1)(11α20 + 8α0 − 12) 4 − 4α0 − 2α20

+(α20 − 16α0 + 12)(α20 + 2α0 − 2) ε2 = 4h(α20 + 2α0 − 2) (10α0 − 8) 4 − 4α0 − 2α20 + 23α20 − 44α0 + 20 +2(3α0 − 2) (34α20 − 55α0 + 22) 4 − 4α0 − 2α20

+(19α0 − 14)(α20 + 2α0 − 2) . Notice that limh→∞ ε(h, α0 ) = 0, and so this proves the existence of the algorithm GACD L. 5

Actually there are a few minor errors that can creep in due to: underestimating the determinant (since a0 ∼ b0 , but a0 = b0 ), transferring between the L1 norm and L2 norms, the fact that there is a 2(m−1)/4 LLL approximation factor and the common divisor may be overestimated (again since a0 ∼ b0 , but a0 = b0 ).

62

5

Nick Howgrave-Graham

An Equivalent Problem?

In this paper we have been considering equations where d divides both a0 + x and b0 + y, and d is particularly large with respect to the sizes of x and y. Notice that we may write this as b (a0 + x) − a (b0 + y) = 0 where now a = (a0 + x)/d and b = (b0 + y)/d are particularly small. A very related problem to this is ﬁnding small a and b such that there exists small x, y which satisfy b (a0 + x) − a (b0 + y) = 1. The author knows of no reduction between these two problems, but as we shall the techniques used to solve them are remarkably similar. The partial variant of the second problem is very related to cryptography; indeed it has recently been named “the small inverse problem” in [3]. The connection with cryptography was ﬁrst realised in [15] where it was shown (via a continued fraction method) that the use of a low decrypting exponent in RSA (i.e. one less than a quarter of the bits of the modulus N ) is highly insecure; the public information of N and e eﬀectively leaks the factorisation of N in polynomial time! The problem was re-addressed in [3], where the new attack was now based on Coppersmith’s lattice techniques, and the bound for which the decrypting exponent √ likely reveals the factorisation of N (in polynomial time) was increased to 1 − 1/ 2 of the bits of N . It is a heuristic method, but seems to work very reliably in practice. In [3] it was hypothesised that this √ bound might be increased to 1/2 the bits of N , because the bound of 1 − 1/ 2 seemed unnatural. However the author would like√to point out that this state of aﬀairs is unlikely, and in fact the bound of 1 − 1/ 2 is natural in that it is exactly what one would expect from the related PACDP. Indeed if one had the bound β0 = 1/2 − ε for α0 = 1/2 for the PACDP (as one might expect the two problems to have the same bound), then this would imply a polynomial time factoring algorithm for RSA moduli6 ! We note that this does not prove the falsity of the conjecture (even assuming factoring is not possible in polynomial time) because there is no known reduction between the small inverse problem and the PACDP (in either direction). However it does mean that for the conjecture to be true, the fact that the r.h.s. of the above equation is 1 rather than 0 must be of key importance to the algorithm which ﬁnds a , b (which is not the case in any of the known attacks). 6

One would just need to guess a constant amount of the top order bits of a factor of p, and use the algorithm to ﬁnd the remaining bits.

Approximate Integer Common Divisors

6

63

Results

We sum up the results in the last sections by showing their bounds graphically. The variables α = logb0 M and β = logb0 X are represented below by the x− and y− axes respectively. The lines show the maximum β for which the common divisor d can still be recovered for any given α ∈ (0 . . . 1). Figure 61. The Bounds Implied by the Approximate Common Divisor Algorithms. 1

0.75

0.5

0.25

0

0

0.25

0.5

0.75

1

The top line is β = α2 which is the bound implied by PACD L. It is responsible for theorems such as “factoring with high bits known”, and (with a slight extension) “factoring integers of the form N = pr q”; see [1] and [5]. The straight line given by β = 2α − 1 is the bound implied by PACD CF, and is equivalent to Wiener’s attack on low decrypting exponent RSA. The line for GACD CF starts oﬀ the same, but after α = 2/3 it then becomes the line β = 1 − α to ensure a polynomial sized output. The curved line between the previous two is

1 1 β = 1 − α − 1 − α − α2 . 2 2 This is a new (but heuristic) lattice based result, explained in section 4, which also applies to GACDP. It interestingly shows that the problem may be solved even when α < 1/2. We now give some practical results to demonstrate the last of these methods working in practice. We show that indeed we can recover the common divisor d

64

Nick Howgrave-Graham

in reasonable time, and that the size of the short vectors are not signiﬁcantly smaller than predicted by the Minkowski bound, which impies that no sublattice of the one we reduce will reveal a better determinant analysis (this ratio is given logarithmically below by δ). The results were carried out on a Pentium II 700MHz machine, running Redhat Linux. The software was written in C++ and used the NTL Library [13]. Notice that for consistency the total number of bits of a and b was kept near 1024. Table 1. Table of Practical Results.

# bits of # bits of α βmax h u time(s) δ # bits of divisor a,b error 205 1025 0.2 0.016 10 1 731 0.941 5 307 1023 0.3 0.041 5 1 8 0.998 15 6 1 20 0.972 20 7 1 43 0.965 22 410 1025 0.4 0.079 4 1 2 0.984 43 5 2 28 0.990 41 6 2 83 0.987 51 7 2 197 0.990 56 512 1024 0.5 0.137 4 2 9 0.994 103 5 2 34 0.993 107 6 3 261 0.996 113 614 1023 0.6 0.231 4 3 18 0.998 213 5 3 100 0.990 207 6 4 507 0.997 216

β 0.004 0.012 0.019 0.019 0.041 0.040 0.049 0.055 0.100 0.104 0.110 0.208 0.204 0.211

(We bring to the readers attention the fact that some of the above choices for u are sub-optimal. This eﬀect can be noticed in the bound on β).

7

Conclusions and Open Problems

The ﬁrst problem is to ﬁnd more uses for approximate integer common divisor problems in cryptography, or any other part of computational mathematics (especially for the general case). Without this the techniques described herein will ﬁnd it hard to reach a large target audience. Another interesting question is to see if one can ﬁnd reductions between the “= 0” and “= 1” variants given in section 5, i.e. the small inverse problem and PACDP. The next obvious thing to do is to generalise ACDPs even more. For instance one could complete the analysis (aluded to in section 4) of when dr divides a number close to one of the inputs. Alternatively one could work out the bounds

Approximate Integer Common Divisors

65

when one has many inputs, all close to numbers which share a large common divisor d. For completeness these extensions will appear in the ﬁnal version of this paper. The last problems are of a more fundamental nature to do with lattice analysis. The proof of algebraic independence of the two bivariate polynomials still remains as a key result to prove in this ﬁeld. A proof would turn both this method and the ones described in [3] and [4] in to “fully ﬂedged” polynomial time algorithms, rather than the heuristic methods they are currently written up as. Of course as shown by [9] it is not possible to hope for a general solution to bivariate modular equations, but in this particular case (and others) one may hope to ﬁnd a rigorous proof. Finally we ask if the bounds implied by section 4 are the best possible, in polynomial time? One way in which this result may not be optimal, is that our determinant analysis may be too pessimistic, or alternatively there may be a sublattice of this lattice, for which the reduced dimension and determinant imply better bounds on the GACDP (for example this type of eﬀect was seen in the ﬁrst lattice built in [3]). Evidence against both of these states of aﬀairs is given by the results in Table 1, i.e. they do show that the vectors obtained are approximately what one would expect from the Minkowski bound (though for smaller α there is a small observed discrepancy), which means that neither of these above situations is likely with our method. This being said, it still remains a very interesting and open theoretical question to be able to identify, in advance, which lattices are built “incorrectly”, i.e. those for which some of the rows actually hinder the determinant analysis (e.g. like the ﬁrst one in [3]). A third way to improve the results is that one could build an entirely diﬀerent lattice, whose analyis simply admitted better bounds than the ones reached here. Nothing is presently known about the existence or non-existence of such an algorithm. Acknowledgements The author would particularly like to thank Don Coppersmith, Yuval Ishai and Phong Nguyen for interesting conversations relating to this subject, and is also very grateful for the period of time spent on this problem at HP Labs in Bristol.

References 1. D. Coppersmith. Finding a small root of a bivariate integer equation Proc. of Eurocrypt’96 Lecture Notes in Computer Science, Vol. 1233, Springer-Verlag, 1996 2. D. Boneh. Twenty years of attacks on the RSA cryptosystem. Notices of the American Mathematical Society (AMS) Vol. 46, No. 2, pp. 203–213, 1999. 3. D. Boneh and G. Durfee. Cryptanalysis of RSA with private key d less than N 0.292 IEEE Transactions on Information Theory, Vol 46, No. 4, pp. 1339–1349, July 2000.

66

Nick Howgrave-Graham

4. D. Boneh, G. Durfee and Y. Frankel. An attack on RSA given a small fraction of the private key bits. In proceedings AsiaCrypt’98, Lecture Notes in Computer Science, Vol. 1514, Springer-Verlag, pp. 25–34, 1998. 5. D. Boneh, G. Durfee and N. Howgrave-Graham Factoring N = pr q for large r. In Proceedings Crypto ’99, Lecture Notes in Computer Science, Vol. 1666, SpringerVerlag, pp. 326–337, 1999. 6. G.H. Hardy and E.M. Wright. An introduction to the theory of numbers, 5’th edition. Oxford University press, 1979. 7. N.A. Howgrave-Graham. Computational mathematics inspired by RSA. Ph.D. Thesis, Bath University, 1999. 8. A.K. Lenstra, H.W. Lenstra and L. Lov´ asz. Factoring polynomials with integer coeﬃcients Mathematische Annalen, Vol. 261, pp. 513–534, 1982. 9. K.L. Manders and L.M. Adleman. NP-Complete decision problems for binary quadratics JCSS Vol. 16(2), pp. 168–184, 1978. 10. P. Nguyen and J. Stern. Lattice reduction in cryptology: An update”, Algorithmic Number Theory – Proc. of ANTS-IV, volume 1838 of LNCS. Springer-Verlag, 2000. 11. T. Okamoto. Fast public–key cryptosystem using congruent polynomial equations Electronic letters, Vol. 22, No. 11, pp. 581–582, 1986. 12. C–P. Schnorr. A hierarchy of polynomial time lattice bases reduction algorithms Theoretical computer science, Vol. 53, pp. 201–224, 1987. 13. V. Shoup. NTL: A Library for doing Number Theory (version 4.2) http://www.shoup.net 14. B. Vall´ee, M. Girault and P. Toﬃn. Proceedings of Eurocrypt ’88 LNCS vol. 330, pp. 281–291, 1988. 15. M. Wiener. Cryptanalysis of short RSA secret exponents IEEE Transactions of Information Theory volume 36, pages 553-558, 1990.

Segment LLL-Reduction of Lattice Bases Henrik Koy1 and Claus Peter Schnorr2 1 2

Deutsche Bank AG, Frankfurt am Main [email protected] Fachbereiche Mathematik und Informatik Universit¨ at Frankfurt, PSF 111932 D-60054 Frankfurt am Main, Germany [email protected]

Abstract. We present an eﬃcient variant of LLL-reduction of lattice ´ sz. We organize LLLbases in the sense of Lenstra, Lenstra, Lova reduction in segments of size k. Local LLL-reduction of segments is done using local coordinates of dimension k. We introduce segment LLL-reduced bases, a variant of LLL-reduced bases achieving a slightly weaker notion of reducedness, but speeding up the reduction time of lattices of dimension n by a factor n. We also introduce a variant of LLL-reduction using iterated segments. The resulting reduction algorithm runs in O(n3 log2 n) arithmetic steps for integer lattices of dimension n with basis vectors of length 2n . Keywords: LLL-reduction, shortest lattice vector, segments, iterated segments, local coordinates, local LLL-reduction, divide and conquer.

1

Introduction

The famous algorithm for LLL-reduction of lattice bases of Lenstra, Lenstra, ´sz [LLL82] is a basic technique for solving important problems in algoLova rithmic number theory, integer optimization, diophantine approximation and cryptography. Of the many possible applications we refer to a few recent ones [BN00,Bo00,Co97,NS00]. Present codes for LLL-reduction merely perform for lattices up to dimension 350, our new contributions lift this barrier beyond dimension 1000. In this paper we present a theoretic reduction algorithm together with a rigorous analysis counting the number of arithmetic steps on integers of bounded length. In the companion paper [KS01] we introduce an orthogonalization via scaling using ﬂoating point arithmetic that is stable in very high dimension. The resulting segment LLL-reduction with ﬂoating point orthogonalization is a highly practical reduction algorithm that is in practice much faster than previous codes for LLL-reduction. In practice it ﬁnds a lattice basis that is as good as a truly LLL-reduced basis. In this paper we propose the concept of segment LLL-reduction in which a basis b1 , . . . , bn of dimension n = km is partitioned into m segments bkl+1 , . . . , bkl+k of k consecutive basis vectors. Segment LLL-reduction is designed to do most of the LLL-exchanges within the segments using local coordinates of dimension k. There is a double advantage. Firstly, local LLL-vector operations cost merely J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 67–80, 2001. c Springer-Verlag Berlin Heidelberg 2001

68

Henrik Koy and Claus Peter Schnorr

O(k) arithmetic steps, whereas global vector operations require O(n) steps. Secondly, as local operations are for lattices of small dimension they can be done in single precision whereas global operations require multi-precision steps. First we introduce k-segment reduced bases, a variant of LLL-reduced bases that is designed to minimize the global overhead associated to the local LLLreductions. Segment LLL-reduction saves a factor n in the running time compared to standard LLL-reduction of lattices of dimension n. Using iterated segments we present an even faster theoretic reduction algorithm that runs in O(n3 log2 n) arithmetic steps for integer lattices of dimension n with basis vectors of length O(2n ). In this paper we analyse a theoretic version of the novel reduction algorithms in the model of integer arithmetic. In the companion paper [KS01] we propose a practical implementation using ﬂoating point orthogonalization. Our present code reduces lattice bases of dimension 1000 consisting of integers of bit length 400 in 10 hours on a 800 MHz PC. Even for dimension n < 100 the new code is in practice much faster than previous codes. We did not yet implement reduction using iterated segments. The use of iterated segments should further speed up the reduction in high dimensions. Previously, Sch¨ onhage [Sc84] has used local coordinates to speed-up LLLreduction. His concept of semi-reduction approximates the length of the shortest lattice vector up to a factor 2n whereas we get close to a factor (4/3)n/2 . We use the [Sc84] analysis of the size of integers occuring during the reduction. Future work. We expect that the practical reduction algorithm of [KS01] will greatly improve the present codes for ﬁnding very short lattice vectors, in particular for lattices of high dimension. LLL-reduction is the basis for the more powerful reduction algorithms of Kannan [K84] and of block reduction of Schnorr [S87,S94]. Combining the segment LLL-reduction with the techniques of [S87,S94,SH95] will speed up the search for very short basis vectors. The novel concept of segment LLL-reduction and the block reduction of [S87,S94] are based on similar structures and can be easily combined. Moreover, the search for very short lattice vectors can be enhanced by the new concept of primal-dual segment reduction proposed by Koy [K01].

2

LLL-Reduction of Lattice Bases

Let Rd be the d–dimensional real vector space with the Euclidean inner product . , . and the Euclidean norm, called the length, y = y, y1/2 . An integer lattice L ⊂ Zd is an additive subgroup of Zd . Its dimension is the dimension of the minimal linear subspace that contains L. Every lattice L of dimension n has a basis, i.e., a set b1 , . . . , bn of linearly independent vectors satisfying L = t1 b1 + . . . + tn bn t1 , . . . , tn ∈ Z . Let L(b1 , . . . , bn ) denote the lattice with basis b1 , . . . , bn . With an ordered lattice basis b1 , . . . , bn ∈ Zd we associate the Gram–Schmidt orthogonalization b1 , . . . , bn ∈ Rd which can be computed together with the

Segment LLL-Reduction of Lattice Bases

69

Gram–Schmidt coeﬃcients µj,i = bj , bi / bi , bi by the recursion b1 = b1 , bj = bj −

j−1

µj,ibi

for j = 2, . . . , n.

i=1

We have µj,j = 1 and µj,i = 0 for i > j. From the above equations we have the Gram–Schmidt decomposition [b1 , . . . , bn ] = [b1 , . . . , bn ] [µj,i ] 1≤i,j≤n , where [b1 , . . . , bn ] denotes the matrix with column vectors b1 , . . . , bn and [µj,i ] is the transpose of the matrix [µj,i ]. The determinant of the lattice L(b1 , ..., bn ) is deﬁned det L = det([b1 , ..., bn ][b1 , ..., bn ] )1/2 . Definition 1. An ordered basis b1 , . . . , bn ∈ Zd of the lattice L is LLL-reduced with δ ∈] 14 , 1] if it has properties 1. and 2.: 1.

|µj,i | ≤ 1/2

for 1 ≤ i < j ≤ n,

2.

δ bi 2 ≤ µ2i+1,i bi 2 + bi+1 2

for i = 1, . . . , n − 1.

LLL-reduced bases have been introduced by A.K. Lenstra, H.W. Lenstra, ´sz [LLL82] who focused on δ = 3/4. A basis with property Jr. and L. Lova 1. is called size-reduced. A basis b1 , ..., bn is good if the values bi are good approximations to the successive minima. The i–th successive minimum λi of a lattice L, relative to the Euclidean norm, is the smallest real number r such that there are i linearly independent vectors in L of length at most r. Extending [LLL82] to arbitrary δ ∈] 14 , 1] and α := 1/(δ − 14 ) yields Theorem 1. A basis b1 , . . . , bn of lattice L that is LLL–reduced with δ satisfies: for i = 1, . . . , n, 1. bi 2 ≤ αn−1 λ2i and b1 2 ≤ αi−1 bi 2 n−1 2 2 2 2 − n−1 2 n 2 (det L) and bn ≥ α (det L) n . 2. b1 ≤ α Consider the QR-factorization B = QR of the basis matrix B = [b1 , . . . , bn ] ∈ Zd×n , where Q ∈ Rd×d is an orthogonal matrix and R = [ri,j ] = [r1 , ..., rn ] ∈ Rd×n is an upper triangular matrix, ri,j = 0 for i > j. We have µj,i = ri,j /ri,i and |ri,i | = ˆbi . We present the core of the LLL-reduction algorithm using the coeﬃcients ri,j of the matrix R. The vector rl is the orthogonal transform of bl . LLL INPUT b1 , . . . , bn ∈ Zd , δ OUTPUT b1 , . . . , bn LLL-reduced basis 1. l := 1 (l is the stage) 2. while l ≤ n do compute rl = (r1,l , ..., rl,l , 0, ..., 0) ,

70

Henrik Koy and Claus Peter Schnorr

size-reduce bl against bl−1 , ..., b1 . 2 2 2 > rl−1,l + rl,l if l = 1 and δrl−1,l−1 then swap bl−1 , bl , l := l − 1 else l := l + 1.

end

The LLL-algorithm locally reduces the 2 × 2-diagonal submatrices of R by successively decreasing the length of the ﬁrst column vector in a 2 × 2-matrix. While the coeﬃcients ri,j of the matrix R are not rational, rational arithmetic must use the rational numbers µj,i , bi 2 satisfying ri,j = µj,i bi , ri,i = bi .

r1,1

r1,n

rl−1,l−1 rl−1,l

R=

0

l−1

rl,l

0

l

rn,n

Fig. 1. The 2 × 2-Diagonal Submatrices of R. LLL-time bound. Following [Sc84] we measure the size of the input in terms of MSc =def max (2n , bi 2 , Di ), i=1,...,n

where

Di = b1 2 · · · bi 2

is the Gramian determinant of the sublattice with basis b1 , ..., bi . The MSc measure diﬀerentiates large and small lattice determinants. It relates to the [LLL82]-measure M = maxi bi 2 by M ≤ MSc ≤ M n . By the Lov´ asz volume argument, the number of LLL-exchanges — swaps of bl−1 , bl — is at most (n − 1) log1/δ MSc . Size-reduction of bl requires O(dl) arithmetic steps. LLL performs at most O(n2 d log1/δ MSc ) arithmetic steps. These steps operate on rational integers where numerator and denominator have at most O(log2 MSc ) bits, see [LLL82,Sc84].

3

Segment LLL-Reduction

Segments and Local Coordinates. Let the basis b1 , . . . , bn ∈ Zd have dimension n = k · m and the QR-factorization [b1 , . . . , bn ] = QR. We partition the basis matrix B into m segments Bl = [bk(l−1)+1 , . . . , bkl ] for l = 1, ..., m. Local reduction of two consecutive segments uses the 2k × 2k-submatrix Rl := [rkl+i,kl+j ]−k
Segment LLL-Reduction of Lattice Bases

71

the LLL-exchanges and the corresponding size-reduction in local coordinates of some Rl . Extra global transformations are required after local LLL-reduction. The novel concept of k-segment reduced bases intends to minimize these global costs. We let D(l) = bk(l−1)+1 2 · · · bkl 2 denote the local Gramian determinant of segment Bl . We have that Dkl = D(1) · · · D(l). Definition 2. We call an ordered basis b1 , . . . , bn ∈ Zd , n = km, k-segment LLL-reduced with δ ∈ ] 14 , 1] if it is size-reduced and satisfies for α = 1/(δ − 14 ) : 1. δ bi 2 ≤ µ2 bi 2 + bi+1 2 for i = 0 mod k, i+1,i

2. 3.

2

D(l) ≤ (α/δ)k D(l + 1) for l = 1, . . . , m − 1, 2 δ k bkl 2 ≤ αbkl+1 2 for l = 1, . . . , m − 1.

We use Inequality 3. to bound in Theorem 2 bi by the successive minimum 1 λi . Without Inequality 3. we bound in Theorem 5 b1 by (det L) n as well as √ 2 by bn . The large exponent k 2 of δ k in 3. is impractical for k > n, we drop Inequality 3. of the deﬁnition 2 in Section 4. Lemma 1. A k-segment LLL-reduced basis b1 , . . . , bn satisfies 2 1. δ 2k +j−i bi 2 ≤ αj−i bj 2 for 1 ≤ i < j ≤ n, 2 2. δ n−1 b1 2 ≤ αn−1 bn 2 and δ k +j−1 b1 2 ≤ αj−1 bj 2 for 1 < j ≤ n.

Proof. The inequalities 2. of Deﬁnition 2 imply for l ≤ l that D(l) ≤ (α/δ)k

2

(l −l)

D(l ).

As D(l) = bk(l−1)+1 2 · · · bkl 2 , there exists s, 1 ≤ s ≤ k such that bk(l−1)+s 2 ≤ (α/δ)k(l −l) bk(l −1)+s 2 .

Inequality 1. follows by combining the latter inequality — at each end k(l−1)+s and k(l − 1) + s — with some inequalities bν 2 ≤ αbν+1 2 , which hold within the segments, and possibly with an inequality 3. of Deﬁnition 2 that bridges two consecutive segments. In particular, we can choose l, l so that i ≤ k(l − 1) + s ≤ k(l − 1) + s ≤ j and that each pair {i, k(l − 1) + s} and {j, k(l − 1) + s} are indices either of the same or of two consecutive segments. Inequalities 2. If i = 1, j = n we can choose l = 1, l = m, and thus each pair {1, k(l − 1) + s}, {n, k(l − 1) + s} is in a single segment. Consequently, we have that δ n−1 b1 2 ≤ αn−1 bn 2 . If i = 1 the pair {i, k(l − 1) + s} is in one segment 2 and thus δ k +j−1 b1 2 ≤ αj−1 bj 2 .

72

Henrik Koy and Claus Peter Schnorr

Theorem 2. Let b1 , . . . , bn be a basis that is k-segment LLL-reduced with δ. Then we have for i = 1, . . . , n : δ 2k

2

+n−1

bi 2 ≤ αn−1 λ2i

δk

and

2

+i−1

b1 2 ≤ αi−1 bi 2 ,

where λ1 ≤ · · · ≤ λn are the successive minima of the lattice. The proof of Theorem 2 follows from Lemma 1 by standard arguments. Comparison of Theorems 1 and 2 shows that k-segment reduced bases are close to LLL-reduced bases. Algorithm for Segment LLL-Reduction. The algorithm segment LLL transforms a given basis into a k-segment reduced basis. It iterates local LLL-reduction of two segments [Bl−1 , Bl ] = [bkl−k+1 , ..., bkl+k ] via: The procedure loc-LLL(l). Given the orthogonalization of a k-segment reduced basis b1 , ..., bkl−k the procedure loc-LLL(l) computes the orthogonalization and size-reduction of the segments Bl−1 , Bl . In particular it provides the submatrix Rl ∈ R2k×2k of R ∈ Rd×n corresponding to the segments Bl−1 , Bl . Thereafter it performs a local LLL–reduction of Rl and stores the LLL-transformation in the matrix H ∈ Z2k×2k . Finally, it transforms [Bl−1 , Bl ] into the locally reduced segments [Bl−1 , Bl ]H and size-reduces [Bl−1 , Bl ] globally.

R=

Rl

Bl−1 Bl

0 Fig. 2. Areas of Subsequent Local LLL-Reductions. Each execution of loc-LLL(l) induces a global overhead of O(ndk) arithmetic steps for global size-reduction, orthogonalization and segment transformation via H. The eﬃciency relies on the fast local LLL-reduction of Rl . Here each LLL-exchange of two consecutive basis vectors costs merely O(k 2 ) arithmetic steps, local size-reduction included. Compare this to the O(nd) arithmetic steps for an LLL-exchange in global coordinates. Here is our segment LLL-reduction algorithm.

Segment LLL-Reduction of Lattice Bases

73

Segment LLL INPUT b1 , . . . , bn ∈ Zd , k, m, n = km, δ OUTPUT b1 , . . . , bn k-segment LLL-reduced basis 1. l := 1 2. while l ≤ m − 1 do loc-LLL(l) if l = 1 and 2 2 ( D(l − 1) > (α/δ)k D(l) or δ k bk(l−1) 2 > αbk(l−1)+1 2 ) then l := l − 1 else l := l + 1. end The original LLL-algorithm — with δ replaced by δ 2 — essentially coincides with the case k = 1 of segment LLL. 1 Segment LLL proceeds like the original LLL-algorithm replacing vectors by segments of size k. Obviously, segment LLL results in a k-segment LLL-reduced basis. Time Analysis. The dominant work of segment LLL consists of the global overhead of the executions of loc-LLL(l). Initial and ﬁnal global size-reduction of the segments Bl−1 , Bl cost O(ndk) arithmetic steps per execution. These costs also cover the initial computation of the column vectors rkl−k+1 , ..., rkl+k ∈ Rd of the matrix R and the global transform of [Bl−1 , Bl ] into [Bl−1 , Bl ]H. Note that the overhead O(ndk) of loc-LLL(l) is linear in the segment size k. Next we show by the Lov´ asz volume argument that the number of executions of loc-LLL decreases cubically in k. We let decr denote the number of times that the condition 2 2 D(l − 1) > (α/δ)k D(l) or δ k bkl 2 > αbkl+1 2

holds and l is decreased for some l. The number of iterations of the while loop and the number of executions of loc-LLL is m − 1 + 2 · decr. n Theorem 3. decr ≤ 2 m−1 k2 log1/δ MSc < 2 k3 log1/δ MSc .

Remarks. 1. For k = 1, m = n the bound of Theorem 3 shows that there are at most (n − 1) log1/δ MSc LLL-exchanges of two consecutive basis vectors during reduction. The factor 2 in Theorem 3 disappears as segment LLL with k = 1 corresponds to LLL using δ 2 . 2. reduction reverses the order of the basis b1 , ..., bn we have decr ≥ mIf them(m−1) . Then, by Theorem 3 we must have that log1/δ MSc ≥ nk/4, = 2 2 MSc ≥ δ −nk/4 . Thus, the bound MSc must be rather large for interesting bases. 1

2

2 The inequality D(l − 1) > (α/δ)k D(l) holds for k = 1 if and only if δ rl−1,l−1 > 2 2 α rl,l . Multiplying the latter inequality by α = 1/(δ − 14 ) implies that δ 2 rl−1,l−1 > 2 1 2 r + r which violates an Inequality 2. of Deﬁnition 1 provided that δ is l,l 4 l−1,l−1 replaced by δ 2 .

74

Henrik Koy and Claus Peter Schnorr

Proof. The Gramian determinant Dkl is the product Dkl = D(1) · · · D(l) of the ﬁrst l local determinants. loc-LLL(l) performs a local LLL-reduction of two segments Bl−1 , Bl , it merely changes Dk(l−1) , the Gramian determinant of b1 , ..., bkl−k , and leaves Dkl for l = l − 1 unchanged. Consider an execution of loc-LLL(l) performed after a decrease of l. We 2 show that it decreases D(l − 1) by the factor δ k /2 . First consider the case that 2 2 D(l−1) > (α/δ)k D(l) holds upon entry of loc-LLL. As Dter (l−1) ≤ αk Dter (l) holds upon termination, and since the product D(l − 1)D(l) does not change we have that 2

Dter (l − 1) ≤ αk Dter (l) 2

= αk D(l − 1)D(l)/Dter (l − 1) 2

≤ δ k D(l − 1)2 /Dter (l − 1), 2

and thus Dter (l − 1) ≤ δ k /2 D(l − 1). 2 If loc-LLL(l) is performed in the case δ k bkl 2 > αbkl+1 2 the previous 2 argument shows again that Dter (l − 1) ≤ δ k /2 D(l − 1). Hence, loc-LLL(l) m−1 2 decreases D =def j=1 Djk by the factor δ k /2 . As D is a positive integer, m−1 D ≤ MSc this implies m−1 decr ≤ log1/δk2 /2 MSc ≤ 2 m−1 k2 log1/δ MSc .

√ Theorem 4. For k = Θ(m) = Θ( n) segment LLL performs O(nd log1/δ MSc ) arithmetic steps using integers of bit length O(log2 MSc ). Proof. Time Bound. There are at most (n log1/δ MSc ) LLL-exchanges — each requiring O(k 2 ) steps for local size-reduction. There are decr ≤ 2 km2 log1/δ MSc calls of loc-LLL — each requiring O(ndk) arithmetic steps for global sizereduction, global orthogonalization and √ global transformation of two consecutive segments. The choice k, m = Θ( n) equalizes for d = O(n) the theoretic time bounds O(k 2 n log1/δ MSc ) for the LLL-exchanges in local coordinates and O(n2 k kn3 log1/δ MSc ) for the global overhead. We need that MSc ≥ 2n , otherwise the O(nd log1/δ MSc ) bound does not cover the O(n2 d) steps required for QR-factorization, the m− 1 calls loc-LLL(l) for l = 1, ..., m − 1 also require O(n2 d) steps for global size-reduction. Size of the integers. We ﬁrst show that the initial bound MSc = max (2n , bi 2 , Di ) i=1,...,n

can temporarily increase not more than by a factor 2 αn−1 for δ ≥ 34 . Recall that the determinants Di do not increase during LLL-reduction. In particular,

Segment LLL-Reduction of Lattice Bases

75

we always have that 1 ≤ Di ≤ MSc , and bi 2 = Di /Di+1 is a rational integer, −1 ≤ bi 2 ≤ MSc with numerator and denominator bounded by MSc . MSc The length bi 2 can only temporarily increase during size-reduction of bi according to bi := bi − µi,h bh for h = i − 1, ..., 1. Assuming that b1 , ..., bi−1 is already LLL-reduced we have that b , b bi i h |µi,h | = ≤ MSc αi−1 . ≤ bh , bh bh We see that, during size-reduction of bi , the value max(b1 2 , ..., bi 2 ) can temporarily increase not more than by a factor 2 αi−1 for δ ≥ 34 . Consider the coeﬃcients of the matrix H ∈ Z2k×2k representing the local LLL-reduction of the segments Bl−1 , Bl so that local LLL-reduction of Bl−1 , Bl transforms [Bl−1 , Bl ] := [Bl−1 , Bl ]H. We let bj , bj , µj,i denote the values corresponding to the transformed segments [bkl−k+1 , ..., bkl+k ] = [Bl−1 , Bl ]H. We let H1 denote the maximal 1 -norm of the columns of H. Lemma 2. [Sc84, Inequality (3.3)] We have that 1. H = ([µj,i ] )−1 [bi , bj bi −2 ]kl−k
Proof. Equality 1. follows from the equations [bkl−k+1 , ..., bkl+k ] = [bkl−k+1 , ..., bkl+k ][µj,i ] , , ..., b ] = [b , ..., b ][µ ] [b kl−k+1

kl+k

kl−k+1

kl+k

j,i

= [bkl−k+1 , ..., bkl+k ][µj,i ] H. When starting the local LLL-reduction of Rl the segments are already sizereduced, i.e., |µj,i | ≤ 12 for kl − k < i < j ≤ kl + k. Then the coeﬃcients νj,i of the inverse matrix [νj,i ] = [µj,i ]−1 satisfy |νj,i | ≤ ( 32 )|j−i| . Inequality 2. follows from 1. as |bi , bj bi −2 | ≤ bj /bi ≤ MSc and |µj,i | ≤ 12 for i < j. Conclusion. All integers arising during the reduction are bounded in absolute value by 3 2 2 , 2 αn−1 MSc ) ≤ MSc for δ ≥ . max(MSc 4 The algorithm segment LLL improves the LLL-time bound — for the case √ n = km, k = Θ( n) — from O(n2 d log1/δ MSc ) to O(nd log1/δ MSc ) arithmetic steps, saving a time factor n. Optimal Segment Size. For k < m the dominant costs are for the global overhead of the executions of loc-LLL requiring O(k −2 n2 d log1/δ MSc ) arithmetic steps. The LLL-exchanges require O(k 2 n log1/δ MSc ) arithmetic steps using local coordinates. The latter should become dominant for k > m. In practice, the crossover point of the two costs is for k m. This is because the steps for the LLL-exchanges are mostly on small integers. In the [KS01] implemenation, these steps are even in ﬂoating point arithmetic. Large segment sizes as k = n/4 yield good results.

76

4

Henrik Koy and Claus Peter Schnorr

Divide and Conquer Using Iterated Segments

There is a natural way to iterate the concept of segments to subsegments, subsubsegments, etc. Let n = k1 · · · ks be a product of integers k1 , ..., ks ≥ 2, s ≤ log2 n. We consider segments of size n/ks , subsegments of size n/(ks ks−1 ), subsubsegments of size n/(ks ks−1 ks−2 ) and so on. We denote k(σ) := (k1 , ..., kσ ), kσ := k1 · · · kσ for σ = 1, ..., s. There are s − 1 levels of segments, we have kσ segments [bkσ (l−1)+1 , ..., bkσ l ] of size kσ for σ = 1, ..., s−1. For n = k1 · · · ks = ks we let D(l, k(σ)) = bkσ (l−1)+1 2 · · · bkσ l 2 denote the local determinant of the l-th kσ -segment. Also, let k0 := 1

and

D(l, k(0)) := bl 2 .

For n = 2s it is natural to choose k1 = k2 = ... = ks = 2. Recall that √Inequality 3. of Deﬁnition 2 is impractical for segments of size kσ greater than n. We want to use large kσ -segments, where the exponent k2σ of 2 δ kσ in 3. of Deﬁnition 2 gets impractical. Theorem 5 shows that the Inequalities 1. and 2. of Deﬁnition 2 — without Inequality 3. — describe a suﬃciently strong reduction. In the following we drop Inequality 3. to render possible a divide and conquer approach. Theorem 5. Let the basis b1 , . . . , bn , n = k·m of lattice L satisfy the inequalities 1. and 2. of Definition 2. Then we have that 1. ˆbkl+1 2 ≤ (α/δ)k(l −l)−1 ˆbkl 2 for 1 ≤ l < l ≤ n, n−1

2

2. b1 2 ≤ (α/δ) 2 (det L) n n−1 2 3. bn 2 ≥ (δ/α) 2 (det L) n . n−1

2

For comparison LLL-reduced bases b1 , . . . , bn satisfy b1 2 ≤ α 2 (det L) n . Inequality 2. is a bit weaker than the inequality b1 2 ≤ αn−1 λ21 of Theorem 1, but it is suﬃcient for most applications, in particular if δ is close to 1. The dual Inequality 3. is useful in applying the method of [Co97] to ﬁnd small integer solutions of polynomial equations. Proof. Inequality 1. follows from the inequalities ˆbkl+1 2 ≤ (α/δ)i−1 ˆbkl+i 2

for 1 ≤ i ≤ k

that hold within the segments, and an inequality ˆbk(l−1)+s 2 ≤ (α/δ)k(l −l) bk(l −1)+s 2

for some 1 ≤ s ≤ k

that bridges the segments Bl and Bl . The latter inequality holds as D(l) = 2 bk(l−1)+1 2 · · · bkl 2 satisﬁes D(l) ≤ (α/δ)k (l −l) D(l ). To prove Inequality 2. we note that D(1) = ˆb1 2 · · · ˆbk 2

and

b1 2 ≤ αi−1 ˆbi 2

for i = 1, ..., k

Segment LLL-Reduction of Lattice Bases

imply that b1 2 ≤ α

k−1 2

77

1

D(1) k .

Moreover, D(1) · · · D(m) = (det L)2 and D(1) ≤ (α/δ)k k2 m−1 2

2

(i−1)

D(i) imply that

2 m

D(1) ≤ (α/δ)

(det L) .

Combining the two inequalities yields Inequality 2. We get Inequality 3. by applying Inequality 2. to the dual basis b∗1 , ..., b∗n satifying b∗i , bj = δi,j , b∗1 = bn −1 and det(L∗ ) = (det L)−1 . Definition 3. A basis b1 , . . . , bn ∈ Zd , n = k1 · · · ks = ks is called k(s)-segment LLL-reduced with δ ∈ ] 14 , 1] if it is size-reduced and satisfies for α := 1/(δ − 14 ): 2

D(l, k(σ)) ≤ (α/δ σ )(kσ ) D(l + 1, k(σ))

(1)

for l = 0 mod kσ+1 , for σ = 0, ..., s − 1, and l = 1, ..., n/kσ − 1. The exponent σ of δ σ is used for the time bound of Theorem 7. As δ can be chosen very close to 1, the factor δ −σ is still close to 1. Due to the restriction l = 0 mod kσ+1 the inequalities (1) only hold within kσ+1 -segments, they cannot bridge distinct kσ+1 -segments. The inequalities (1) 2 get weaker and weaker as the size kσ of the segments increases and δ kσ decreases. For σ = 0, k0 = k0 = 1, the inequalities (1) mean that bl 2 ≤ αbl+1 2

for l = 1, ..., n − 1, l = 0 mod k1 ,

slightly weakening Clause 1. of Deﬁnition 2. For n = k1 · k2 = k · m, s = 2, Deﬁnition 3 recites clauses 1. and 2. of Deﬁnition 2 slightly weakening 1. and dropping 3.. We next extend Lemma 3 to iterated segments. Theorem 6. A k(s)-segment LLL-reduced basis b1 , . . . , bn , n = k1 · · · ks = ks satisfies b1 2 ≤ (α/δ s−1 )

n−1 2

2

(det L) n

n−1 2 bn 2 ≥ (δ s−1 /α) 2 (det L) n .

and

Proof. We prove by induction on σ that b1 2 ≤ (α/δ σ−1 )

kσ −−1 2

1

D(1, k(σ)) kσ .

The ﬁrst claim of the theorem follows from D(1, k(s)) = (det L)2 , ks = n for σ = s. The second claim follows by duality. The induction hypothesis holds for σ = 1 as we have b1 2 ≤ αi−1 ˆbi 2 for i = 1, . . . , k1 and D(1, k(1)) = ˆb1 2 · · · ˆbk1 2 . The induction hypothesis extends from σ to σ + 1 by the inequalities D(1, k(σ)) ≤ (α/δ σ )(kσ )

2

(l−1)

D(l, k(σ))

for l = 1, . . . , kσ+1

and the equation kσ+1

D(1, k(σ + 1)) =

l=1

D(l, k(σ)).

78

Henrik Koy and Claus Peter Schnorr

ks -segment LLL-reduction. The algorithm ks -segment LLL transforms a given basis into a ks -segment LLL-reduced basis. It iterates ks−1 -segment LLLreduction of two ks−1 -segments [Bl−1 , Bl ] = [bks−1 (l−1)+1 , ..., bks−1 (l+1) ] via the procedure ks−1 -segment LLL. For σ ≥ 1 the procedure kσ - -segment LLL(l) – computes the orthogonal transform of the kσ -segments [Bl−1 , Bl ] providing the local R-matrix Rl ∈ R2kσ ×2kσ , – performs a local kσ−1 -segment LLL-reduction on [Bl−1 , Bl ] by iterating kσ−1 -segment LLL, – stores the corresponding transformation matrix Hl ∈ Z2kσ ×2kσ , – upon termination, it transports Hl to the matrix Hl of the kσ+1 -segment Bl that contains Bl−1 , Bl . The 2kσ columns of Hl corresponding to Bl−1 , Bl are multiplied from the right by Hl . Thereafter, Hl is reset to the identity matrix. While procedure kσ -segment LLL for σ ≥ 1 recursively calls kσ−1 -segment LLL , the procedure k0 -segment LLL(l) exchanges bl−1 and bl in case that bl−1 2 > αbl 2 . ks -segment LLL INPUT b1 , . . . , bn ∈ Zd , n = k1 · · · ks = ks , δ OUTPUT b1 , . . . , bn ks -segment LLL-reduced basis 1. l := 1 2. while l ≤ ks − 1 do ks−1 -segment LLL(l) 2 if l = 1 and D(l − 1, k(s − 1)) > (α/δ σ )(ks−1 ) D(l, k(s − 1)) then l := l − 1 else l := l + 1. end Theorem 7. Given a basis b1 , . . . , bn ∈ Zd , n = k1 · · · ks = ks the algorithm ks -segment LLL produces a ks -segment LLL-reduced basis. It performs at most s kσ2 log1/δ MSc O dn2 + d σ=1

arithmetic steps. If max kσ = O(1) σ

and

log1/δ MSc = O(n2 ),

the number of arithmetic steps is O(n2 d log2 n). Proof. Consider for σ = 1, . . . , s − 1 the number of executions of kσ -segment LLL as sub· · · subroutine of ks -segment LLL. The number of these executions is n/kσ − 1 + 2 · decr(k(σ)), where decr(k(σ)) is the number of times that

Segment LLL-Reduction of Lattice Bases

79

kσ -segment LLL is called as sub· · · subroutine of ks -segment LLL due to a 2 violated inequality (1), where D(l − 1, k(σ)) > (α/δ)(kσ ) D(l, k(σ)) for some l. Formally, kσ -segment LLL is also executed after a decrease of l on some level σ where σ > σ. However, that execution induces no costs except for the case of a violated inequality (1) at level σ. The reason is that the ks -segments are already orthogonalized and size-reduced by previous calls of kσ -segment LLL. Consider the product of the Gramian determinants n/kσ

D(k(σ)) =def

n/kσ

Dkσ l =

l=1

D(1, k(σ) · · · D(l, k(σ)) . l=1

We apply Theorem 3 to kσ -segments. Each execution of kσ -segment LLL — 2 due to a violated inequality (1) — decreases D(k(σ)) by the factor δ (kσ ) /2 . D(k(σ)) is product of n/kσ Gramian determinants. As initially D(k(σ)) ≤ n/k MSc σ , and upon termination D(k(σ)) ≥ 1 we see that decr(k(σ)) ≤

2n log1/δ MSc . (kσ )3

In total there are n/kσ − 1 + (k2n 3 log1/δ MSc executions of kσ -segment σ) LLL each inducing an overhead of O(kσ k2σ+1 ) arithmetic steps. This overhead includes: the orthogonal transform of the kσ -segments Bl−1 , Bl providing the local R-matrix Rl ∈ R2kσ ×2kσ of [Bl−1 , Bl ], the transport of Hl to the transformation matrix Hl of the next higher level and size-reduction of Rl against Rl . The total overhead of all kσ -segment LLL executions is 2 O(nk2σ+1 + nkσ+1 log1/δ MSc ).

In the particular case σ = s − 1, this overhead is O(dk2s + dks2 log1/δ MSc ) as the global transforms are done directly on the basis vectors in Zd . In the particular case σ = 0, the overhead covers a total of O(n log1/δ MSc ) LLL-exchanges of two consecutive vectors which each uses O(k12 ) arithmetic steps for a local exchange and

s a local size-reduction. We see that ks -segment LLL performs O(n2 d + d σ=1 kσ2 log1/δ MSc ) arithmetic steps providing the time bound of the theorem. Conclusion. The time bound of the novel algorithm ks -segment LLL is comparable to that of classical matrix multiplication. The size of the integers occuring in the new reduction algorithm can be bounded by the method of Theorem 4. The algorithm uses integers of bit length O(s log2 MSc ), where s is the number of levels σ. Each level can add O(log2 MSc ) bits when transporting the local transformation Hl to the next higher level.

80

Henrik Koy and Claus Peter Schnorr

References BN00. D. Bleichenbacher and P.Q. Nguyen, Noisy Polynomial Interpolation and Noisy Chinese Remaindering, Proc. Eurocrypt’00, LNCS 1807, SpringerVerlag, pp. 53-69, 2000. Bo00. D. Boneh, Finding Smooth Integers in Small Intervals Using CRT Decoding, Proc. STOC’00, ACM Press, pp. 265-272, 2000. Ca00. J. Cai, The Complexity of some Lattice Problems, Proc. ANTS’00, LNCS 1838, Springer-Verlag, pp. 1-32, 2000. Co97. D. Coppersmith, Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities, J. Crypt. 10, pp. 233-260, 1997. K84. R. Kannan, Minkowski’s Convex Body Theorewm and Integer Programming. Mathematical Operation Research, 12, pp. 415–440, 1984. K01. H. Koy, Notes of a Lecture. Frankfurt 2001. KS01. H. Koy and C.P. Schnorr, LLL-Reduction with Floating Point Orthogonalization. This proceedings CaLC 2001, pp. 81–96. LLL82. A.K. Lenstra, H.W. Lenstra and L. Lov´ asz, Factoring polynomials with rational coeﬃcients, Math. Ann. 261, pp. 515-534, 1982. NS00. P.Q. Nguyen and J. Stern, Lattice Reduction in Cryptology, An Update, Proc. ANTS’00, LNCS 1838, Springer-Verlag, pp. 85-112, 2000. S87. C.P. Schnorr, A hierarchy of polynomial time lattice basis reduction algorithms, Theoretical Computer Science 53, pp. 201-224, 1987. S91. C.P. Schnorr and M. Euchner, Lattice Basis Reduction and Solving Subset Sum Problems. Proceedings FCT’91, LNCS 591, Springer-Verlag, pp. 68–85, 1991. The complete paper appeared in Mathematical Programming Studies, 66A, 2, pp. 181–199, 1994. S94. C.P. Schnorr, Block Reduced Lattice Bases and Successive Minima, Combinatorics, Probability and Computing, 3, pp. 507-522, 1994. SH95. C.P. Schnorr and H. H¨ orner, Attacking the Chor-Rivest Cryptosystem by Improved Lattice Reduction. Proceedings Eurocrypt’95, LNCS 921, SpringerVerlag, pp. 1–12, 1995. Sc84. A. Sch¨ onhage, Factorization of univariate integer polynomials by diophantine approximation and improved lattice basis reduction algorithm, Proc. 11-th Coll. Automata, Languages and Programming, Antwerpen 1984, LNCS 172, Springer-Verlag, pp. 436-447, 1984.

Segment LLL-Reduction with Floating Point Orthogonalization Henrik Koy1 and Claus Peter Schnorr2 1 2

Deutsche Bank AG, Frankfurt am Main [email protected] Fachbereiche Mathematik und Informatik Universit¨ at Frankfurt, PSF 111932 D-60054 Frankfurt am Main, Germany [email protected]

Abstract. We associate with an integer lattice basis a scaled basis that has orthogonal vectors of nearly equal length. The orthogonal vectors or the QR-factorization of a scaled basis can be accurately computed up to dimension 216 by Householder reﬂexions in ﬂoating point arithmetic (f pa) with 53 precision bits. We develop a highly practical f pa-variant of the new segment LLLreduction of Koy and Schnorr [KS01]. The LLL-steps are guided in this algorithm by the Gram-Schmidt coeﬃcients of an associated scaled basis. The new reduction algorithm is much faster than previous codes for LLL-reduction and performs well beyond dimension 1000. Keywords: LLL-reduction, Householder reﬂexion, ﬂoating point arithmetic, stability, scaled basis, segment LLL-reduction, local LLL-reduction.

1

Introduction

Practical algorithms for LLL-reduction compute the orthogonal vectors of a basis in ﬂoating point arithmetic (f pa). The corresponding f pa-errors must be small otherwise the size-reduction included in the orthogonalization gets unstable. Up to dimension 250 Gram-Schmidt orthogonalization of an LLL-reduced basis can be done in f pa with some correction steps [SE91]. Householder orthogonalization has better stability, as was shown in [RS96]. In practice it yields up to dimension 350 a suﬃcient QR-factorization of the basis matrix — but this process gets unstable in dimension 400. [S88] presents a method for correcting the GramSchmidt coeﬃcients using Schulz’s method of matrix inversion. This method is provably stable but requires O(n + log2 M ) precision bits, where M bounds the Euclidean length of the basis vectors. It is useless for f pa with 53 precision bits. In this paper we associate with an integer lattice basis a scaled basis that has orthogonal vectors of nearly equal length. The orthogonal vectors or the QRfactorization of a scaled basis can be accurately computed up to dimension 216 by Householder reﬂexions in f pa with 53 precision bits. We present an algorithm J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 81–96, 2001. c Springer-Verlag Berlin Heidelberg 2001

82

Henrik Koy and Claus Peter Schnorr

HRS that eﬃciently generates an associated scaled basis. We present a f pavariant of LLL-reduction where LLL-steps are guided by the orthogonal vectors of an associated scaled basis. In particular, size-reduction is done against the scaled basis. The weaker size-reduction does in practice not degrade the quality of the reduced basis. We present a f pa-variant of segment LLL-reduction, a novel concept proposed in [KS01]. The algorithm segment sLLL performs scaled segment LLLreduction, so that all LLL-steps are guided by the orthogonalization of an associated scaled basis. The algorithm segment sLLL is a very eﬃcient reduction algorithm. Its eﬃciency comes from local LLL-reduction of two consecutive segments Bl−1 , Bl that is done by reducing the local matrix Rl in f pa. To make this local LLL-reduction possible in the limits of f pa it is necessary to bound the integer transformation matrix of the local LLL-reduction. For this we carefully prepare the local matrix Rl of Bl−1 , Bl prior to local LLL-reduction. In practice, segment sLLL is much faster than previous codes for LLLreduction. It performs well beyond dimension 1000 and provides lattice bases that are in practice of similar quality as LLL-reduced bases. For dimension 1000 and basis vectors with 400 bit integer coordinates, the new LLL-reduction takes only about 10 hours on a 800 MHz PC. It is the ﬁrst code for LLL-reduction that performs well beyond dimension 350. In this paper we focus on practical aspects related to f pa. A rigorous analysis of segment LLL-reduction in the model of integer arithmetic is in the companion paper [KS01]. For general background on f pa and Householder transformation see [LH95].

2

Stability Properties of Householder Orthogonalization

For an introduction of LLL-reduced lattice bases and of our notation on lattices we refer to Section 2 of the companion paper [KS01]. For easy reference we recall Deﬁnition 1 and Theorem 1 from [KS01]. We let δ ∈] 14 , 1] and α = 1/(δ − 14 ). Definition 1. An ordered basis b1 , . . . , bn ∈ Zd of the lattice L is LLL-reduced with δ ∈] 14 , 1] if it has properties 1. and 2.: 1.

|µj,i | ≤ 1/2

2.

δ bi 2 ≤ µ2i+1,i bi 2 + bi+1 2

for 1 ≤ i < j ≤ n, for i = 1, . . . , n − 1.

Theorem 1. A basis b1 , . . . , bn of lattice L that is LLL-reduced with δ satisﬁes: 1. bi 2 ≤ αn−1 λ2i and b1 2 ≤ αi−1 bi 2 for i = 1, . . . , n, n−1 n−1 2 2 2 2 − 2. b1 ≤ α 2 (det L) n and bn ≥ α 2 (det L) n . Accuracy of Householder Reﬂexions. Consider the QR-factorization B = QR of the basis matrix B = [b1 , . . . , bn ] ∈ Zd×n , where Q ∈ Rd×d is an orthogonal matrix and R = [ri,j ] = [r1 , ..., rn ] ∈ Rd×n is an upper triangular matrix, ri,j = 0

Segment LLL-Reduction with Floating Point Orthogonalization

83

for i > j. We have µj,i = ri,j /ri,i and |ri,i | = bi . The vector rl is the orthogonal transform of bl . Consider the process of orthogonalization of a basis matrix B = [b1 , ..., bn ]. In ideal arithmetic we get the QR-factorization B = QR by a sequence of Householder transformations C1 := B, Cj+1 := Qj Cj

for j = 1, . . . , n,

where Qj ∈ Rd×d is an orthogonal matrix — an Householder reﬂexion — that produces zeros in positions j + 1 through d of column j of Qj Cj . Thus Cj+1 ∈ Rd×n is upper triangular in the ﬁrst j columns. Finally, R = Cn+1

and

Q = Qn · · · Q1 .

In actual computation, however, we use ﬂoating point operations ¯ j C¯j ) C¯1 = f l(B), C¯j+1 := f l(Q

for j = 1, . . . , n.

We assume the standard f pa-model of Wilkinson, see [LH95, page 85] for details. Let 0 < η 1 be the relative precision — each ﬂoating point operation induces a normalized relative error bounded in magnitude by η. 1 In this model, it has been shown [LH95, page 87, formula (15.38)] that C¯j+1 − Qj · · · Q1 BF ≤ (6d − 3j + 40)jη BF + O(η 2 ), (1) 1 where AF = ( i,j a2i,j ) 2 denotes the Frobenius norm of the matrix A = [ai,j ]. In the following we neglect the low order term O(η 2 ). Thus, in actual ¯ = [¯ computation we get R ri,j ] = C¯n+1 satisfying for n ≥ 14, ¯ − RF ≤ 6dnη BF . R

(2)

It follows that the approximate Gram-Schmidt coeﬃcients µ ¯j,i = r¯i,j /¯ ri,i satisfy for i < j |¯ µj,i − µj,i | ≤ 6djη b1 , . . . , bj F /(|ri,i |(1 − ε)) (3) provided that |¯ ri,i − ri,i | ≤ ε|ri,i |. Therefore, we get from inequality (2) the following lemma. Lemma 1. Inequality (3) holds provided that 6djη b1 , . . . , bj F ≤ ε|ri,i |.

(4)

Instability of Householder QR-Factorization for Dimension 400. Inequalities (1), (2), (3) are rather sharp. To combine Householder transformation and sizereduction we need accurate coeﬃcients µj,i . Condition (4) characterizes the stability of Householder transformation — stability requires that 6dnη BF < mini |ri,i |. 1

Standard double length, wired f pa has 53 precision bits, η = 2−53 .

84

Henrik Koy and Claus Peter Schnorr

On the other hand, Theorem 2 shows that random LLL-reduced bases on the average satisfy b1 ≈ 1.1n−1 bn . For dimension n = 400 and η = 2−53 this yields 6dnη b1 F ≈ 6dnη1.1n−1 bn ≈ 4 · 106 bn . Inequality (4) is grossly violated. Therefore, Householder transformation of LLLreduced bases is necessarily unstable in dimension 400 for f pa with 53 precision bits. Theorem 2. Consider a random LLL-reduced basis with random coeﬃcients µi+1,i ∈R [− 21 , 12 ] for i = 1, ..., n − 1, and let the inequalities 2. of Deﬁnition 1 be tight. Then b1 ≈ 1.1n−1 bn holds on the average. Proof. While (δ − µ2i+1,i )bi 2 ≤ bi+1 2 holds for LLL-reduced bases, the converse (δ − ε2 )bi 2 ≥ bi+1 2 holds provided that δbi 2 = bi+1 2 + µ2i+1,i bi 2

and

|µi+1,i | ≤ ε.

The inequality |µi+1,i | ≤ ε holds with probability 2ε for random values of µi+1,i ∈R [− 12 , 12 ]. As 12 1 1 2 and 2ε dε = δ − ≈ 1.1−1 1 6 6 −2 holds for δ ≈ 1 we see that b1 ≈ 1.1n−1 bn holds on the average.

3

The Scaled Basis Matrix

Scaling is a well known method for improving the stability of f pa. We associate with an integer lattice basis b1 , ..., bn a scaled basis bs1 , ..., bsn that has orthogonal vectors of nearly equal length. Definition 2. Let b1 , . . . , bn be a basis of an integer lattice L. We call bs1 , ..., bsn ∈ L an associated scaled basis with scaling factors 2e1 , ..., 2en , where e1 , ..., en ∈ N, if bs1 , ..., bsn form a size-reduced basis of a sublattice of L satisfying bs1 ≤ 2ei bi = bsi < 2bs1

for i = 1, . . . , n.

(5)

We show in Theorem 3 that a given scaled basis yields accurate Gram-Schmidt coeﬃcients by Householder reﬂexions in f pa. In Section 4 we show how to produce an associated scaled basis eﬃciently in f pa. In Sections 5 and 7 we use an associated scaled basis to guide LLL-reduction and segment LLL-reduction. We can easily transform a basis b1 , ..., bn into an associated scaled basis bs1 , ..., bsn using exact arithmetic — ﬁrst scale then size-reduce: 1. scaling. e1 := log2 (maxj bj /b1 ) , bs1 := 2e1 b1 , for i = 2, ..., n do ei := max(0, log2 bs1 /bi), bsi := 2ei bi

Segment LLL-Reduction with Floating Point Orthogonalization

2. size-reduction. for j = 2, ..., n for i = j−1, ..., 1 do

bsj

:=

bsj −

bsj , bsi bs 2 i

85

bsi . 2

New Notation. For the remaining of the paper we let the column vector rν of the R-matrix be related to the scaled vector bsν rather than to the original vector bν . The size of scaled Gram-Schmidt coeﬃcients. The coeﬃcients µsν,j of an arbitrary, unscaled vector ν−1 µsν,j bsj bν = bν + j=1

are uniformly bounded: Corollary 1. |µsν,j | =

|bν , bsj | bν (5) bν ≤ ≤ 2· s . s s 2 b1 bj bj

In contrast, LLL-reduced bases b1 , . . . , bν−1 satisfy bν =

ν

µν,j bj

with

|µν,j |2 ≤

j=1

bν 2 j−1 α . b1 2

The coeﬃcient µν,ν−1 that enters ﬁrst into size-reduction of bν tends to be very large due to the factor αν−1 . A small relative error of µν,ν−1 confuses the sizereduction of bν . Corollary 2. The basis bs1 , . . . , bsn satisﬁes bsj ≤ Proof. bsj 2 = bsj 2 +

j + 3 bs1

for j = 1, . . . , n.

j−1

s 2 s 2 i=1 (µj,i ) bi

≤ bsj 2 + (j − 1)/4 maxi<j (bsi )2 (5)

≤ 4bs1 2 + (j − 1) bs1 2 = (j + 3)bs1 2 .

Next we study for a given scaled basis the accuracy of the approximate coeﬃcients µ ¯sj,i , computed in f pa by Householder reﬂexions. Theorem 3. The approximate µ ¯sj,i of bs1 , . . . , bsn satisfy |¯ µsj,i − µsj,i | ≤ ε/(1 − ε) 2

for ε = 6dj 2 η.

Let r = r − 12 be the nearest integer to the real number r.

86

Henrik Koy and Claus Peter Schnorr

Proof. By scaling and size-reduction we have for j = 2: bsj 2

3

j−1

(5) 1 s 2 j+3 maxi≤j bsi 2 ≤ j mini≤j bsi 2 . ≤ bi + bsj 2 ≤ 4 i=1 4

j √ Hence bs1 , . . . , bsj F = ( i=1 bsi 2 )1/2 ≤ j maxi≤j bsi ≤ j bsi , and thus bs1 , . . . , bsj F /bsi ≤ j

for i = 1, ..., j.

(6)

Hence, Inequality (4) holds for ε = 6dj 2 η. By Lemma 1 Inequality (3) holds for that ε and thus (3)

|¯ µsj,i − µsj,i | ≤ 6djη bs1 , . . . , bsj F /(|ri,i |(1 − ε)) (6)

≤ 6dj 2 η/(1 − ε) = ε/(1 − ε).

Stability up to Dimension 216 . Consider Theorem 3 in the case j ≤ n = d = 216 and η = 2−53 . Then we have ε ≤ 6n3 η ≤ 0.19 and ε/(1 − ε) ≤ 0.24. Therefore, Householder reﬂexions yield up to dimension 216 suﬃciently accurate GramSchmidt coeﬃcients for the basis bs1 , . . . , bsn .

4

Orthogonalization via Scaling and Size-Reduction

Suppose we are given bs1 , . . . , bsν−1 , bν and we want to produce a scaled vector bsν . At that point the µsj,i of bs1 , . . . , bsν−1 are given with high accuracy. We iteratively transform bν into bsν using better and better approximations of the µsν,i . The procedure HRS (Householder, Reduction, Scaling) iterates the following steps ¯ ν−1 · · · Q ¯ 1 bν , 1. the ﬁrst ν − 1 Householder transformations bν → Q 2. size-reduction of bν against bs1 , . . . , bsν−1 , 3. scaling of bν to bsν . Steps 1. and 2. must be iterated as the size of bν is by Inequality (2) crucial for the accuracy of Householder transformation. As the scaling increases the size of bν we scale in stages, repeating 1. 2. after each stage of scaling. Let Qj = Id − 2vj vj vj −2 , where Id ∈ Zd×d is the identity matrix and vj ∈ Rd is the Householder vector associated with Qj . Note that x → Qj x reﬂects x at the hyperplane that is orthogonal to vj : Qj vj = −vj , Qj u = u for u ⊥ vj . HRS is given for input the Householder vectors v1 , ..., vν−1 ∈ Rd , the ﬁrst ¯ ν−1 · · · Q ¯ 1 C¯1 and the computed rν−1 of the matrix C¯ν = Q ν − 1 columns ¯ r1 , ..., ¯ s scaling exponents e¯1 , ..., e¯ν−1 . The operations on b1 , ..., bsν−1 are in exact integer arithmetic, the other operations are in f pa. Taking f pa-errors into account we relax size-reduction of bsν to the relaxed condition |µsν,j | ≤ 0.52. 3

In the following we neglect the exception j = 2.

Segment LLL-Reduction with Floating Point Orthogonalization

87

Suppressing Backward Rescaling. Upon entry of HRS(ν), the scaled vectors bs1 , ..., bsν−1 are given while bsν , ..., bsn are unknown. At this stage the scaling factors 2e¯1 , ..., 2e¯ν−1 correspond to the subbasis b1 , ..., bν−1 . If bν > bs1 we would need to rescale bsi by increasing e¯i := e¯i + e¯ and bsi := 2e¯ bsi for e¯ := log2 (bν /bs1 ) and i = 1, ..., ν − 1. We suppress this backward rescaling. It is suﬃcient to store e¯ and to do all subsequent size-reductions against 2e¯ bsi rather than against bsi , i.e., we replace subsequent reduction steps −¯ e bs b, bsi b, 2 i b := b − bsi bsi . by the steps b := b − 2e¯ bs , bs bs , bs i

i

i

i

For simplicity, the program HRS(ν) does not include the steps required in case that bν > bs1 . HRS(ν) (Householder Transformation, Reduction and Scaling of bν ) INPUT bs1 , . . . , bsν−1 ∈ Zd , ¯ r1 , ..., ¯ rν−1 , v1 , . . . , vν−1 ∈ Qd , e¯1 , ..., e¯ν−1 ∈ Z rν , e¯ν OUTPUT bsν (size-reduced against bs1 , ..., bsν−1 ), vν , ¯ s 1. e¯ν := 0, bν := bν ¯ ν−1 · · · Q ¯ 1 · bs 2. ¯ rν := Q ν 3. size-reduce bsν against bs1 , ..., bsν−1 for i = ν − 1, . . . , 1 do µ ¯sν,i := r¯i,ν / r¯i,i if |¯ µsν,i | ≥ 0.51 then bsν := bsν − ¯ µsν,i bsi , ¯ rν := ¯ rν − ¯ µsν,i ¯ ri 4. if ∃i : |¯ µsν,i | ≥ 210 then go to 2. d 1 2 5. τ := ( i=ν r¯i,ν ) 2 , e := min(log2 (bs1 /τ ), 30) 6. if e˜ > 0 then e¯ν := e¯ν + e , bsν := 2e bsν go to 2. d 1 2 ¯ ν−1 · · · Q ¯ 1 bs , σ := sig(¯ rν,ν ), τ := ( i=ν r¯i,ν )2 7. ¯ rν := Q ν vν := (0, . . . , 0, r¯ν,ν + στ, r¯ν+1,ν , . . . , r¯d,ν ) ¯ rν := (¯ r1,ν , . . . , r¯ν−1,ν , − − στ, 0, . . . , 0)

end

How HRS Works. According to (5) the input vectors bs1 , ..., bsν−1 satisfy |r1,1 | ≤ |ri,i | < 2|r1,1 | Let 6dν 2 η < that

1 2

for i = 1, ..., ν − 1.

so that Theorem 3 holds for ε = 12 . Then, by (2) and (6) we have |¯ ri,i − ri,i | ≤ 6dj 2 η|ri,i |

for i = 1, ..., j.

Reducing Long bν . By (2) the relative error of r¯i,ν /bν in step 2. is at most 6dνη. The subsequent size-reduction reduces the large r¯i,ν — in the equation 2 bν 2 = di=1 ri,ν — to less than |¯ ri,i | in absolute value. Steps 2. 3. 4. decrease

88

Henrik Koy and Claus Peter Schnorr

1 2 the ( ν−1 ¯i,ν ) 2 –part until the inequality i=1 r

ν−1

2 r¯i,ν

12

≤ bs1 , ..., bsν−1 F

i=1

holds. Upon entry of step 3. the coeﬃcients µsν,i are uniformly bounded as |µsν,j | ≤ 2 ·

bν , bs1

see Corollary 1. Size-reduction of Step 3. can temporarily increase the coeﬃcients |µsν,j | up to a factor (3/2)ν−j−1 in worst case. This could possibly make the sizereduction of step 3. unstable in worst case. No such instability has been reported in practice, see Figure 1. Scaling Up Small bν . Let bν ≤ bs1 , ..., bsν−1 F

and|rν,ν | ≤ ηbν .

By (2) and (6) we have after step 2. that |¯ rν,ν − rν,ν | < 6dνη bs1 , ..., bsν−1 F ≤ 6dν 2 ηbs1 . This yields a scaling factor e˜ for step 6. so that 2e˜ ≥ (6dν 2 η)−1 > 1. Therefore, steps 2. to 6. increase |¯ rν,ν | and bsν until rν,ν | ≈ bsν < 2|¯ r1,1 |. |¯ r1,1 | ≤ |¯ Corollary 3. HRS(ν) produces a scaled vector bsν satisfying |µsν,i | ≤ 0.52 for i = 1, ..., ν − 1 provided that size-reduction of Step 3. remains stable. Speeding Up HRS. To speed up HRS replace the rounded values ¯ µsν,i in step s 3. by single precision integers consisting of the leading bits of ¯ µν,i . This way HRS becomes very fast. The Number of Arithmetic Steps. A matrix-vector multiplication ¯ 1 bν = bν − bν → Q

2v1 v1 bν v1 2

requires 2d multiplications and one division — as usual we neglect the ad¯ ν−1 · · · Q ¯ 1 bν using 2νd multiplicaditions/subtractions. Thus, we get ¯ rν := Q tions/divisions. Size-reduction of step 3. requires νd multiplications in exact arithmetic. In total, one round of steps 2., 3., and 4. requires 2νd multiplications/divisions in f pa and νd exact multiplications of long integers.

Segment LLL-Reduction with Floating Point Orthogonalization

89

The Number of Rounds. In practice each round of steps 2. 3. 4. either decreases ν−1 1 2 ( i=1 ri,ν ) 2 by the factor 6dν 2 η, or increases bsν by the scaling factor 2e¯ν ≥ (6dν 2 η)−1 > 1, or does a combination of both, see the explanations for HRS. In practice we ﬁnd that HRS(ν) requires log2 (bν /bν )/| log2 (6dν 2 η)| rounds. Practical Performance of HRS. Consider a random public-key basis of the GGH-cryptosystem [GGH] of dimension 400. Figure 1 shows how HRS(400) decreases the coeﬃcients |µ400,j | of the last basis vector b400 . Using 53 bit f pa each of ﬁve rounds decreases |µ400,j | by a factor about 109 ≈ 230 . After each round all coeﬃcients |µ400,j | are of nearly equal size because the preceding orthogonal vectors have been scaled to nearly equal length bsj . After each of the ﬁrst 4 rounds however, |µsν,j | increases by about a factor 10 as j decreases from 400 to 1. This is due to the temporary increase of |µsν,j | by a factor (3/2)ν−j−1 in worst case. Figure 1 shows that this temporary increase has little eﬀect in practice. Using 106 bit f pa — instead of 53 bit f pa — the ﬁve rounds of HRS(400) reduce to two rounds, and the running time of HRS reduces accordingly. Software implemented f pa with 106 precision bits makes the reduction clearly faster than the standard f pa with 53 precision bits.

1030 1020 1010

40

80

120

160

200 j

240

280

320

360

Fig. 1. Displayed are the values |µ400,j | upon termination of each of ﬁve rounds. The |µ400,j | are measured after step 2 of the next round — after new orthogonalization.

90

5

Henrik Koy and Claus Peter Schnorr

Scaled LLL-Reduction

We introduce scaled LLL-reduced lattice bases, and we present an algorithm scaled LLL for scaled LLL-reduction. This algorithm is a useful prelude to the more complicated scaled segment LLL-reduction of Section 7. Definition 3. We call a lattice basis b1 , . . . , bn ∈ Zd scaled LLL-reduced if it has properties 1. and 2. 1.

There is an associated scaled basis bs1 , ..., bsn so that b1 , ..., bn is size-reduced against bs1 , ..., bsn , i.e., b , bs ν j for 1 ≤ i < j ≤ n, s ≤ 0.52 b 2 j

2.

δ bi 2 ≤ αbi+1 2

for i = 1, . . . , n − 1.

We call a basis with property 1. scaled-reduced. Importantly, the inequalities of Theorem 1 still hold for scaled LLL-reduced lattice bases. The weaker sizereduction does not aﬀect these inequalities. Scaled LLL-reduced bases are in practice as good as LLL-reduced bases. Next we present an algorithm scaled LLL that transforms a lattice basis into a scaled LLL-reduced basis of the same lattice. Scaled LLL guides the LLLsteps on the original basis by the orthogonalization of an associated scaled basis. So we keep and update two versions of the basis. LLL-transformations operate on the original basis. Size-reduction is done against the scaled basis. This form of LLL-reduction is quite stable as HRS yields an accurate QR-factorization of the scaled basis. The Procedure HRS . Local LLL-reduction of two basis vectors bν−1 , bν is guided by the orthogonal vector of a modiﬁed scaled vector bsν — with a scaling factor 2e¯ν that coincides with the scaling factor 2e¯ν−1 of bν−1 . We get the modiﬁed bsν by the following variant HRS of HRS: Set in Step 1. e¯ν := e¯ν−1 and skip Step 6.. Moreover, we let HRS perform in Step 3. the same size-reduction steps bsν := bsν − ¯ µsν,ν−1 bsν−1

and

bν := bν − ¯ µsν,ν−1 bν−1

on bsν against bsν−1 and on bν against bν−1 . As a consequence we have: Lemma 2. The reduction coeﬃcients of bν against bν−1 and of bsν against bsν−1 coincide in HRS (ν), and thus µν,ν−1 = µsν,ν−1 . The output vector bν of HRS (ν) is size-reduced against bν−1 . The coeﬃcients ri,j for ν −1 ≤ i, j ≤ ν associated with bν−1 , bν are proportional to the coeﬃcients associated with bsν−1 , bsν with proportionality factor 2e¯ν .

Segment LLL-Reduction with Floating Point Orthogonalization

91

Scaled LLL (Algorithm for scaled LLL-reduction.) INPUT b1 , . . . , bn ∈ Zd , δ OUTPUT b1 , . . . , bn scaled LLL-reduced basis 1. ν := 1 2. while ν ≤ n do 3. if ν = 1 then HRS(1), ν := 2 4. HRS (ν) 2 2 2 5. if δ r¯ν−1,ν−1 > r¯ν−1,ν + r¯ν,ν then swap bν−1 , bν , ν := ν − 1 else HRS(ν), ν := ν + 1 end Scaling Does Not Aﬀect LLL-Exchanges. By Lemma 2, the output vector bν of HRS (ν) is size-reduced against bν−1 , i.e., |µν,ν−1 | ≤ 0.52. Moreover, the decision about swapping bν−1 , bν in Step 5. is the same as for the original LLLalgorithm — except for f pa-errors. d 2 f pa-errors do not aﬀect the LLL-exchanges. We see from bsν 2 = i=1 ri,ν and s s rν,ν | and |rν,ν |/bν is at (2) that the relative error of r¯ν−1,ν /bν ≈ r¯ν−1,ν /|¯ most 6dνη. On the other hand, |¯ rν−1,ν−1 | ≥ bs1 holds by scaling. Therefore, the decision about swapping bν−1 , bν in Step 5. is correct for 6dνη 1.

6

Segment LLL-Reduction

We summarize the concept of segment LLL-reduced bases of the companion paper, for full coverage see [KS01]. Segments and Local Coordinates. Let the basis b1 , . . . , bn ∈ Zd have dimension n = k · m and the QR-factorization [b1 , . . . , bn ] = QR. We partition the basis-matrix B into m segments Bl = [bk(l−1)+1 , . . . , bkl ] for l = 1, ..., m. Local reduction of two consecutive segments uses the coeﬃcients of the submatrix Rl := [rkl+i,kl+j ]−k
2. 3.

2

D(l) ≤ (α/δ)k D(l + 1) for l = 1, . . . , m − 1, 2 δ k bkl 2 ≤ αbkl+1 2 for l = 1, . . . , m − 1.

92

Henrik Koy and Claus Peter Schnorr

Theorem 4. [KS01] Let b1 , . . . , bn be a basis that is k-segment LLL-reduced with δ. Then we have for i = 1, . . . , n: δ 2k

2

+n−1

bi 2 ≤ αn−1 λ2i

and

δk

2

+i−1

b1 2 ≤ αi−1 bi 2 ,

where λ1 ≤ · · · ≤ λn are the successive minima of the lattice. Algorithm for Segment LLL-Reduction. The algorithm segment LLL transforms a given basis into a k-segment reduced basis using exact integer arithmetic. It iterates local LLL-reduction of two segments [Bl−1 , Bl ] = [bkl−k+1 , ..., bkl+k ] via: The Procedure loc-LLL(l). Given the orthogonalization of a k-segment reduced basis b1 , ..., bkl−k the procedure loc-LLL(l) computes the orthogonalization and size-reduction of the segments Bl−1 , Bl . In particular it provides the submatrix Rl ∈ R2k×2k of R ∈ Rd×n corresponding to the segments Bl−1 , Bl . Thereafter it performs a local LLL–reduction of Rl and stores the LLL-transformation in the matrix H ∈ Z2k×2k . Finally, it transforms [Bl−1 , Bl ] into the locally reduced segments [Bl−1 , Bl ]H and size-reduces [Bl−1 , Bl ] globally. Segment LLL INPUT b1 , . . . , bn ∈ Zd , k, m, n = km, δ OUTPUT b1 , . . . , bn k-segment LLL-reduced basis 1. l := 1 2. while l ≤ m − 1 do loc-LLL(l) if l = 1 and 2 2 ( D(l − 1) > (α/δ)k D(l) or δ k bk(l−1) 2 > αbk(l−1)+1 2 ) then l := l − 1 else l := l + 1. end √ Theorem 5. [KS01] For k = Θ(m) = Θ( n), segment LLL performs O(nd log1/δ M ) arithmetic steps using integers of bit length O(log2 M ).

7

Scaled Segment LLL-Reduction

We combine the methods of Sections 4 and 6 to a stable algorithm for segment LLL-reduction. Size-reduction is done against an associated scaled basis. Segment LLL-reduction is guided by the orthogonal vectors of the scaled basis. Definition 5. We call a basis b1 , . . . , bn ∈ Zd k-segment sLLL-reduced, if it is k-segment LLL-reduced except that b1 , ..., bn is size-reduced in a weaker sense — it is size-reduced against an associated basis bs1 , ..., bsn with the properties 1. and 2.

Segment LLL-Reduction with Floating Point Orthogonalization

1.

93

The ﬁrst orthogonal vectors bskl−k+1 of segments are nearly equally long: bs1 ≤ 2ekl bkl−k+1 = bskl−k+1 < 2bs1

for l = 1, ..., m.

2. There is a uniform scaling factor 2ekl for segment Bl so that the coeﬃcients rkl−k+i,kl−k+j , for 1 ≤ i, j ≤ k of the R-matrix corresponding to b1 , ..., bn and those corresponding to bs1 , ..., bsn are proportional with proportionality factor 2ekl . The inequalities for k-segment LLL-reduced bases in Theorem 4 also hold for k-segment sLLL-reduced bases. The weaker size-reduction is not important. In practice k-segment sLLL-reduced bases are nearly as good as LLL-reduced bases. We sketch a procedure loc-sLLL(l) — for local scaled LLL-reduction — that replaces loc-LLL(l) within segment LLL. The algorithm segment sLLL iterates local scaled LLL-reduction of two consecutive segments [Bl−1 , Bl ] = [bkl−k+1 , ..., bkl+k ]. The Procedure loc-sLLL(l). Its inputs are a lattice basis, uniform scaling factors 2e¯k satisfying bsk−j = 2e¯k bk−j for j = 0, ..., k − 1, + = 1, ..., l − 1. The Householder vectors v1 , ..., vk(l−1) of b1 , ..., bk(l−1) and the matrix R ∈ Rd×k(l−1) for [bs1 , ..., bsk(l−1) ] are also given. Local LLL-reduction of Bl−1 , Bl is done in f pa via the local matrix Rl ∈ R2k×2k . The procedure loc-sLLL(l): – – – – –

computes a uniform scaling factor 2e¯kl for the two segments [Bl−1 , Bl ], computes the local matrix Rl of 2e¯kl [Bl−1 , Bl ] via HRS , performs a local LLL-reduction on [Bl−1 , Bl ] using Rl , stores the transformation in the matrix H ∈ Z2k×2k . Upon termination it transforms [Bl−1 , Bl ] into [Bl−1 , Bl ]H in exact arithmetic.

Restarting loc-sLLL(l). Whenever H∞ surpasses the threshold 215 the procedure loc-sLLL(l) is restarted with the transformed segments [Bl−1 , Bl ]H. This is necessary as the norm H∞ directly translates into additional f pa-errors. As the number of restarts is crucial for the running time we carefully prepare Rl as to prevent an early restart. We show below how to predict the size of the matrix H ∈ Z2k×2k occuring in the subsequent local LLL-reduction of Bl−1 , Bl . We slash Rl so that H∞ ≤ 215 holds on the average. The threshold 215 is for wired 53-bit f pa, for 106-bit f pa we increase the threshold accordingly. Computing the Matrix Rl and 2e¯kl . First compute via HRS the uniform scaling factor 2e¯kl and the ﬁrst vector rkl−k+1 of Bl−1 so that bs1 ≤ 2ekl bkl−k+1 = bskl−k+1 < 2bs1 . With the same scaling factor 2e¯kl compute rh via HRS for h = kl − k + 2, ..., kl + k. For local LLL-reduction we have to size-reduce bh against bkl−k+1 , . . . bh−1 . We generalize Step 3. of HRS accordingly: perform µsh,j bsj , bh := bh − ¯ µsh,j bj on bsh the same size-reduction steps bsh := bsh − ¯

94

Henrik Koy and Claus Peter Schnorr

against bsj and on bh against bj for j = kl − k + 1, . . . h − 1. This implies that the local matrix Rl of segments Bl−1 , Bl corresponding to b1 , ..., bn and the Rl corresponding to bs1 , ..., bsn are proportional with the factor 2e¯kl . l = rkl−k+i,kl−k+j denote the coeﬃThe Heuristic for Slashing Rl . We let ri,j l l cients of the local matrix Rl . Large values |r1,1 /rj,j | have a double negative eﬀect on the stability of loc-sLLL(l). By Lemma 1 the orthogonalization of bj gets inaccurate. Moreover, H∞ will be large due to Lemma 2 [KS01]. A detailed arl l gument shows that H∞ is expected to be less than 215 if maxj |r1,1 /rj,j | ≤ 215 . l l 15 This suggests to slash Rl so that maxj |r1,1 /rj,j | ≤ 2 . l l l | — satisfying |r1,1 /rj,j | < 2−15 — Slashing the Matrix Rl . Slash all values |rj,j l l l := |r1,1 |2−15 . Moreover, set rh,i := 0 for h = j, ..., 2k and h < i ≤ 2k. to rj,j



l l l · · · r1,j−1 r1,j r1,1 . ..  .. ..  . .  l l  0 r r j−1,j−1 j−1,j  Rl :=  l  0 ··· 0 |r1,1 |2−15   . ..  .. . 0 ··· 0 0

··· ···

l r1,k .. .

l rj−1,k

0 ..

.

          

l |2−15 |r1,1

We locally LLL-reduce the slashed matrix Rl , and afterwards we transform [Bl−1 , Bl ] into [Bl−1 , Bl ]H. If either H∞ > 215 or if the slashing did eﬀectively change Rl we restart the local reduction with the transformed segments [Bl−1 , Bl ]H. Note that a restart of loc-sLLL(l) also adjusts the uniform scaling factor 2e¯kl . This method of correction works very well for segment size k ≤ 100. Segment sLLL INPUT b1 , . . . , bn ∈ Zd , k, m, n = km, δ OUTPUT b1 , . . . , bn k-segment and scaled reduced basis 1. l := 1 2. while l ≤ m − 1 do loc-sLLL(l) if l = 1 and 2 2 ( D(l − 1) > (α/δ)k D(l) or δ k bkl 2 > αbkl+1 2 ) then l := l − 1 else l := l + 1. end

8

Performance of Segment sLLL

Consider a sample of [GGH]-bases of dimension n = ν · 100 for ν = 1, . . . , 8. The vectors of the input basis consist of integers with n/2 bits. The algorithm uses 106 bit f pa and δ = 0.99 respectively δ = 0.999. All tests have been performed on 350 MHz PC’s, the code of segment sLLL uses the [NTL] computer algebra

Segment LLL-Reduction with Floating Point Orthogonalization Lattice dimension 100 200 300 400 500 600 700 800

δ = 0.99 segment size 25 40 45 50 50 60 60 70

lav 7.9 13.8 23.0 30.5 34.3 38.8 40.9 46.6

95

δ = 0.999 segment size lav 25 5.2 40 9.4 45 14.7 50 17.7 56 22.6 60 27.9 65 34.3 70 37.0

Fig. 2. segment sLLL Reduced Bases. lav = Average Bit Length of the Output Integers.

library. We present the segment size and the average bit length of the reduced basis vectors in Figure 2. The running time increases considerably as δ approaches 1. The size of the reduced basis decreases accordingly. Figure 3 shows the time of segment sLLL for [GGH]-bases.

25

time [hrs]

20

delta = 0.99 delta = 0.999

15 10 5 0 100

200

300

400 500 lattice dimension

600

700

800

Fig. 3. Running Time of Segment sLLL Using δ = 0.99 resp. δ = 0.999.

Acknowledgment We thank Bartol Filipovi´c for his help in producing and measuring the code of the new reduction algorithm.

96

Henrik Koy and Claus Peter Schnorr

References GGH. O. Goldreich, S. Goldwasser, and S. Halevi, Public-key cryptosystems from lattice reduction problems. Proc. Crypto’97, LNCS 1294, Springer-Verlag, pp. 112–131, 1997. KS01. H. Koy and C.P. Schnorr, Segment LLL-Reduction of Lattice Bases. Proceedings CaLC 2001, pp. 67–80. LLL82. A.K. Lenstra, H.W. Lenstra, and L. Lov´ asz, Factoring polynomials with rational coeﬃcients, Math. Ann. 261, pp. 515–534, 1982. LH95. C.L. Lawson and R.J. Hanson, Solving Least Square Problems, SIAM, Philadelphia, 1995. NTL. NTL homepage: http://www.shoup.net/ntl/, 2000. RS96. C. R¨ ossner and C.P. Schnorr, An optimal stable continued fraction algorithm for arbitrary dimension. 5.-th IPCO, LNCS 1084, pp. 31–43, Springer-Verlag, 1996. S87. C.P. Schnorr, A hierarchy of polynomial time lattice basis reduction algorithms, Theoretical Computer Science 53, pp. 201-224, 1987. S88. C.P. Schnorr, A more eﬃcient algorithm for lattice basis reduction, J. Algorithms 9, pp. 47–62, 1988. SE91. C.P. Schnorr and M. Euchner, Lattice Basis Reduction: Improved Practical Algorithms and Solving Subset Sum Problems, Proc. Fundamentals of Computation Theory’91, L. Budach, ed., LNCS 529, Springer-Verlag, pp. 68-85, 1991. (Complete paper in Mathematical Programming Studies 66A, No 2 , pp. 181–199, 1994.) Sc84. A. Sch¨ onhage, Factorization of univariate integer polynomials by diophantine approximation and improved lattice basis reduction algorithm, Proc. 11-th Coll. Automata, Languages and Programming, Antwerpen 1984, LNCS 172, Springer-Verlag, pp. 436–447, 1984.

The Insecurity of Nyberg–Rueppel and Other DSA-Like Signature Schemes with Partially Known Nonces Edwin El Mahassni1 , Phong Q. Nguyen2 , and Igor E. Shparlinski3 1

3

Department of Computing, Macquarie University, NSW 2109, Australia [email protected] 2 ´ Ecole Normale Sup´erieure, D´epartement d’Informatique 45 rue d’Ulm, 75005 Paris, France [email protected] http://www.di.ens.fr/~pnguyen/ Department of Computing, Macquarie University, NSW 2109, Australia [email protected] http://www.comp.mq.edu.au/~igor/

Abstract. It has recently been proved by Nguyen and Shparlinski that the Digital Signature Algorithm (DSA) is insecure when a few consecutive bits of the random nonces k are known for a reasonably small number of DSA signatures. This result conﬁrmed the eﬃciency of some heuristic lattice attacks designed and numerically veriﬁed by Howgrave-Graham and Smart. Here, we extend the attack to the Nyberg–Rueppel variants of DSA. We use a connection with the hidden number problem introduced by Boneh and Venkatesan and new bounds of exponential sums which might be of independent interest. Keywords: DSA, Closest Vector Problem, Hidden Number Problem, Exponential Sums.

1

Introduction

1.1

The Digital Signature Algorithm (DSA)

Recall the Digital Signature Algorithm (DSA) used in the American federal digital signature standard. Let p and q ≥ 3 be prime numbers with q|p − 1. As usual Fp and Fq denote ﬁelds of p and q elements which we assume to be represented by the elements {0, . . . , p − 1} and {0, . . . , q − 1} respectively. For a rational γ and integer m ≥ 1 we denote by γm the smallest non-negative residue of γ modulo m. Let M be the set of messages to be signed and let h : M −→ Fq be an arbitrary hash function. The signer selects a secret key α ∈ F∗q and computes the public key A = g α p , where g ∈ Fp is a public element of multiplicative order q.

Part of this work is an output of the “Turbo-signatures” project, supported by the French Ministry of Research. Work supported in part by the Australian Research Council.

J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 97–109, 2001. c Springer-Verlag Berlin Heidelberg 2001

98

Edwin El Mahassni, Phong Q. Nguyen, and Igor E. Shparlinski

For an integer k we deﬁne the function r(k) = g k p . q

(1)

Finally, for a random element k ∈ F∗q called a nonce and a message µ ∈ M we deﬁne the function (2) s(k, µ) = k −1 (h(µ) + αr(k)) q and call the pair (r(k), s(k, µ)) the DSA signature of the message µ with a nonce k. 1.2

Lattice Attacks on DSA

Howgrave-Graham and Smart [6] noticed that if some most signiﬁcant bits of k are known for a reasonably small number of signatures then one can apply the LLL lattice reduction algorithm [10] to heuristically recover the secret key α. They also presented numerical results to conﬁrm the eﬃciency of their attack. Nguyen [14] exhibits a close link between this problem and the hidden number problem (HNP) introduced by Boneh and Venkatesan [3,4], together with improved numerical results. HNP can be stated as follows: recover a number α ∈ Fq such that for many known random t ∈ Fq a certain number of the most signiﬁcant bits of αtq are known. Boneh and Venkatesan showed in [3,4] how to solve HNP in polynomial time when the number of bits was roughly log1/2 q and the distribution of t was uniform, using a reduction to the lattice closest vector problem. The link between DSA and HNP is the following. Assume that we know the least signiﬁcant bits of a nonce k ∈ F∗q . That is, we are given an integer a such that 0 ≤ a ≤ 2 − 1 and k − a = 2 b for some integer b ≥ 0. Given a message µ signed with the nonce k, the signing equation (1) can be rewritten for s(k, µ) = 0 as: αr(k)2− s(k, µ)−1 ≡ a − s(k, µ)−1 h(µ) 2− + b (mod q). Now deﬁne the following two elements t(k, µ) = 2− r(k)s(k, µ)−1 q u(k, µ) = 2− a − s(k, µ)−1 h(µ) q and remark that both t(k, µ) and u(k, µ) can easily be computed by the attacker from the publicly known information. Recalling that 0 ≤ b ≤ q/2 , we obtain αt(k, µ) − u(k, µ)q < q/2 . Thus, the most signiﬁcant bits of αt(k, µ)q are revealed. Finally, Nguyen and Shparlinski [15] have proved that the heuristic attack of [6,14] always succeeds. This has been done by generalizing the lattice-based proof of Boneh-Venkatesan to cases where the distribution of t is not necessarily perfectly uniform, and more importantly, by proving some uniformity results on the distribution of t in the case of DSA, using bounds of exponential sums.

The Insecurity of Nyberg–Rueppel and Other DSA-Like Signature Schemes

1.3

99

Our Results

In this paper, we extend the results of Nguyen and Shparlinski [15] to several known modiﬁcations of DSA. Although our method is similar to that of [15], the exponential sums arising in this paper are diﬀerent. In particular, we study the ﬁve following modiﬁcations of the signing equation (2) which are outlined in Section 20.4 of [19] (see also Section 11.5.2 in [12] and [18]) DSA1 : DSA2 : DSA3 : DSA4 : DSA5 :

s1 (k, µ) = k −1 (r(k) + αh(µ)) q . −1 s2 (k, µ) = α (h(µ) + kr(k)) q ; s3 (k, µ) = αr(k) + kh(µ)q ; s4 (k, µ) = αh(µ) + kr(k)q ; s5 (k, µ) = α−1 (r(k) + kh(µ)) q .

The DSAi signature on a message µ is (r(k), si (k, µ)), i = 1, . . . , 5. We remark that for these DSA variants, α, h(µ) and k have the same meaning as in the original DSA and r(k) is deﬁned by the same equation (1). By alternating signs in these equations, one obtains additional signature schemes which can be studied quite analogously. We also show that the same method can be applied to yet another modiﬁcation proposed by Nyberg and Rueppel [18] which provides message recovery, see also Section 11.5.4 in [12] and Section 20.4 of [19]. The initial settings of this scheme are the same except that instead of the hash function h mapping M to Fq , we are given a function H whose values are elements of Fp . In fact, the main idea of this scheme is to use an easily invertible (and just one-to-one) function H : M −→ Fp . Then the NR signature (r(k, µ), v(k, µ) is deﬁned by signing equation NR: where

v(k, µ) = αr(k, µ) + kq , r(k, µ) = H(µ)g k p

In this paper we do not discuss advantages and disadvantages of the above schemes (for example, some of them are “inversion”-free and thus the value k = 0 can be selected as well) but remark that for the NR signature scheme one derives H(µ) ≡ g −v(k,µ) Ar(k,µ) r(k, µ) (mod p) where as before A = g α p . So if the function h(µ) is easy to invert, then the message µ can be recovered from the signature itself. One can easily verify that if we are given an integer a such that 0 ≤ a ≤ 2 −1 and k − a = 2 b for some integer b ≥ 0 then for each of the signature schemes DSAi , i = 1, . . . , 5 we have, αti (k, µ) − ui (k, µ)q < q/2 ,

i = 1, . . . , 5,

(3)

100

Edwin El Mahassni, Phong Q. Nguyen, and Igor E. Shparlinski

where

h(µ) , l 2 s1 (k, µ) q s2 (k, µ) , t2 (k, µ) ≡ l 2 r(k) q r(k) , t3 (k, µ) ≡ − l 2 h(µ) q h(µ) t4 (k, µ) ≡ − l , 2 r(k) q s5 (k, µ) , t5 (k, µ) ≡ 2l h(µ) q

t1 (k, µ) ≡

r(k) u1 (k, µ) ≡ 2−l a − ; s1 (k, µ) q h(µ) +a u2 (k, µ) ≡ 2−l ; q r(k) s3 (k, µ) u3 (k, µ) ≡ 2−l a − ; h(µ) q s4 (k, µ) u4 (k, µ) ≡ 2−l a − ; r(k) q r(k) +a u5 (k, µ) ≡ 2−l ; h(µ) q

(for the schemes DSA3 and DSA5 we assume that h : M −→ F∗q ). For the signature scheme NR, we have −l α2 r(k, µ) − w(k, µ) q < q/2 , where

(4)

w(k, µ) = 2−l (v(k, µ) − a) q .

It is important to remark that in the above inequalities the “multipliers” ti (k, µ), r(k, µ) and the “approximations” ui (k, µ), w(k, µ), i = 1, . . . , 5, can be eﬃciently evaluated from publicly available data. Thus to obtain analogues of the results of Nguyen and Shparlinski [15], one has to study the distribution of ti (k, µ), i = 1, . . . , 5, and r(k, µ) for randomly selected nonce k ∈ F∗q and µ ∈ M.

2 2.1

Preparations Preliminaries

Let eq (z) = exp(2πiz/q)

and

ep (z) = exp(2πiz/p).

We recall a few results about exponential which we use to show that our attacks work. The ﬁrst one is the well-known Weil bound on exponential sums with rational functions which is presented in the form given by C. J. Moreno and O. Moreno [13], see also [11]. Lemma 1. For any polynomials g(X), f (X) ∈ Fq [X] such that the rational function F (X) = f (X)/g(X) is not constant on Fq , the bound ∗ eq (F (λ)) ≤ (max{deg g, deg f } + u − 2) q 1/2 + δ λ∈Fq

The Insecurity of Nyberg–Rueppel and Other DSA-Like Signature Schemes

101

holds, where ∗ means that the summation is taken over all λ ∈ Fq which are not poles of F (X) and (v, 1), if deg f ≤ deg g, (u, δ) = (v + 1, 0), if deg f > deg g, and v is the number of distinct zeros of g(X) in the algebraic closure of Fq . We also use the following well-known statement, see Exercise 11.a in Chapter 3 of [23]. Lemma 2. For any integers u and M ≥ 1, M−1 0, if u ≡ 0 (mod M ); exp(2πizu/M ) = M, if u ≡ 0 (mod M ). λ=0

We also need a result from [15] about the distribution of r(k). For an integer ρ ∈ Fq , let N (ρ) be the number of solutions of the equation r(k) = ρ,

k ∈ F∗q .

The following estimate has been obtained in [15] (using some bounds for exponential sums from [8]). Lemma 3. Let Q be a suﬃciently large integer. The following statement holds with ν = 1/3 for all primes p ∈ [Q, 2Q], and with ν = 0 for all primes p ∈ [Q, 2Q] except at most Q5/6+ε of them. For any ε > 0 there exists δ > 0 such that for any element g ∈ Fp of multiplicative order q ≥ pν+ε the bound ρ ∈ [0, q − 1], N (ρ) = O q 1−δ , holds. N

We recall that the discrepancy D(Γ ) of a sequence Γ = (γi )i=1 of N elements of the interval [0, 1] is deﬁned as A(I, N ) − |I| , D(Γ ) = sup N I⊆[0,1] where the supremum is extended over all subintervals I of [0, 1], |I| is the length of I, and A(I, N ) denotes the number of points γn in I for 0 ≤ n ≤ N − 1, see [5,9,17]. Following [15] we say that a ﬁnite sequence T of integers is ∆-homogeneously distributed modulo q if for any integer a coprime with q the discrepancy of the sequence {atq /q}t∈T is at most ∆. For an integer x, we denote by MSB,q (x) any integer u with |x − u| ≤ q/2+1 . Remark that in this inequality is not necessarily an integer. The following generalization of Theorem 1 of [3], using ∆-homogeneously distributed multipliers in the hidden number problem, has been obtained in [15].

102

Edwin El Mahassni, Phong Q. Nguyen, and Igor E. Shparlinski

Lemma 4. For a prime q, deﬁne = log1/2 q + log log q, 1/2 and d = 2 log1/2 q . Let T be a 2− log q -homogeneously distributed modulo q sequence of integer numbers. There exists a deterministic polynomial time algorithm A such that for any ﬁxed integer α in the interval [0, q −1], given a prime q

and 2d integers ti and ui = MSB,q αti q for suﬃciently large q Pr

t1 ,...,td ∈T

for i = 1 . . . , d, its output satisﬁes

[A (q, t1 , . . . , td ; u1 , . . . , ud ) = α] ≥ 1 − 2−(log q)

1/2

log log q

if t1 , . . . , td are chosen uniformly and independently at random from the elements of T . This result and Theorem 1 of [3] rely heavily on the LLL lattice reduction algorithm [10], more precisely on Babai’s approximation algorithm [2] for the closest vector problem in a lattice (see [16] for a brief exposition of the proof). In fact using a combination of the Schnorr modiﬁcation [20] of the lattice basis reduction with a result of Kannan [7] about reduction of the closest vector problem to the shortest vector problem, one can obtain an analogue of Lemma 4 with a slightly smaller value of . This result can be improved even further if one uses a more recent result of [1]. All these improvements are of order of some power of log log q. 2.2

Distribution of Multipliers

Let us denote by Si the set of pairs (k, µ) ∈ [1, q − 1] × M for which the corresponding equation for ti (k, µ) and ti (k, µ) does not contain division by zero. Then i = 1, . . . , 5, (5) |Si | = q|M| 1 + O q −δ , for all p and q satisfying the conditions of Lemma 3. Our results are based on the bounds of exponential sums σi (c) = eq (cti (k, µ)) , i = 1, . . . , 5, (k,µ)∈Si

and τ (c) =

ep (cr(k, µ)) .

µ∈M k∈F∗ q

For a hash function h : M → Fq we also denote by W the number of pairs (µ1 , µ2 ) ∈ M2 with h(µ1 ) = h(µ2 ). Thus, W/|M|2 is a probability of a collision and our results for the schemes DSAi , i = 1, . . . , 5, are nontrivial under a reasonable assumption that this probability is of order of magnitude close to 1/q.

The Insecurity of Nyberg–Rueppel and Other DSA-Like Signature Schemes

103

Lemma 5. Let Q be a suﬃciently large integer. The following statement holds with ν = 1/3 for all primes p ∈ [Q, 2Q], and with ν = 0 for all primes p ∈ [Q, 2Q] except at most Q5/6+ε of them. For any ε > 0 there exists γ > 0 such that for any element g ∈ Fp of multiplicative order q ≥ pν+ε the bound max∗ |σi (c)| = O(W 1/2 q 3/2−γ ) c∈Fq

holds. Proof. Deﬁne R(λ) to be the number of µ ∈ M with h(µ) = λ. Then R(λ)2 = W.

(6)

λ∈M

From the deﬁnition of si (k, µ) and ti (k, µ) we see that (i) ∗ R(λ) eq cFk (λ) , i = 1, . . . , 6, σi = k∈F∗ q

λ∈Fq

where (1)

kλ , r(k) + αλ −λ (4) Fk (λ) = , r(k)

λ − kr(k) −r(k) (3) , Fk (λ) = , αr(k) λ r(k) + kλ (5) Fk (λ) = . αλ

(2)

Fk (λ) =

Fk (λ) =

Using the Cauchy inequality and the identity (6), we obtain 2 (i) eq cF(k,m) (λ) |σi (c)|2 ≤ W λ∈Fq k∈F∗ q (i) ∗ =W eq c Fk,m (λ) , k,m∈F∗ q λ∈Fq

(i)

(i)

(i)

where Fk,m (λ) = Fk (λ) − Fm (λ) and as before

∗

means that the summation

(i) Fk,m ,

is taken over all λ ∈ Fq which are not poles of i = 1, . . . , 5. For i = 1, . . . , 5 we denote by Ni the number of pairs (k, m) ∈ (F∗q )2 for which (i)

the rational function Fk,m (λ) is constant. For these k and m we estimate the inner sum over λ trivially as q. For other k and m, to estimate the inner sum over λ we use Lemma 1 (for i = 1, 5), Lemma 2 (for i = 2, 4) and the identity eq (aλ−1 ) = eq (λ) = −1, a ∈ F∗q , λ∈F∗ q

λ∈F∗ q

(for i = 3). Thus we derive the bound max∗ |σi (c)|2 = O W Ni q + q 2 Bi , c∈Fq

i = 1, . . . , 5,

(7)

104

Edwin El Mahassni, Phong Q. Nguyen, and Igor E. Shparlinski

where Bi is the bound on the corresponding exponential sums, that is   q 1/2 , if i = 1, 5; Bi = 0, if i = 2, 4;  1, if i = 3. Now, we remark that mλ kλ − r(k) + αλ r(m) + αλ λ − kr(k) λ − mr(m) (2) F(k,m) (λ) = − αr(k) αr(m) (1)

F(k,m) (λ) =

are constant only when k = m, thus N1 = N2 = q − 1. For other i = 3, 4, 5 the functions −r(k) −r(m) − , λ λ −λ −λ (4) − , F(k,m) (λ) = r(k) r(m) r(k) + kλ r(m) + mλ (5) F(k,m) (λ) = − αλ αλ (3)

F(k,m) (λ) =

are constant only when r(k) = r(m). Using Lemma 3, we ﬁnd that Ni = O(q 2−δ ), i = 3, 4, 5. Without loss of generality we may assume that δ < 1/4. Substituting the bounds on Bi ≤ q 1/2 and Ni = O(q 2−δ ), i = 1, . . . , 5, in the inequality (7), we obtain the desired result. For a function H : M → Fp we also denote by U the number of pairs (µ1 , µ2 ) ∈ M2 with H(µ1 ) = H(µ2 ). As we have mentioned, in practical applications of the NR scheme H is a one to one function thus U = |M| in this case (although our results remain nontrivial for U of large order). The following statement is a variant of Exercise 14.a, of Chapter 6 of [23] and can be proved quite similarly. Lemma 6. The bound max∗ |τ (c)| ≤ U 1/2 p1/2 q 1/2 c∈Fp

holds. Proof. Deﬁne Q(λ) to be the number of µ ∈ M with H(µ) = λ. Then as in the proof of Lemma 5 we have τ (c) = b ∈ Fp . Q(λ) ep cλg k , λ∈Fp

k∈Fq

The Insecurity of Nyberg–Rueppel and Other DSA-Like Signature Schemes

105

From the Cauchy inequality we derive q−1 2 k |τ (c)| ≤ Q(λ) ep cλg λ∈Fp λ∈Fp k=1 =U ep cλ(g k − g m ) . 2

2

k,m∈Fq λ∈Fq

Using Lemma 2, we see that if gcd(c, p) = 1 the sum over λ is equal p if g k ≡ g m (mod q), that is, if k = m, and vanishes otherwise and the result follows. Lemma 7. Let Q be a suﬃciently large integer. The following statement holds with ν = 1/3 for all primes p ∈ [Q, 2Q], and with ν = 0 for all primes p ∈ [Q, 2Q] except at most Q5/6+ε of them. For any ε > 0, there exists γ > 0 such that for any element g ∈ Fp of multiplicative order q ≥ pν+ε the sequences 1/2 ti (k, µ), (k, µ) ∈ Si , are 2− log q homogeneously distributed modulo q for every i = 1, . . . , 5, provided that |M|2 W ≤ 1−γ . q Proof. Let us ﬁx an integer a coprime with q. According to a general discrepancy bound, given by ( [17], Corollary 3.11) for the discrepancy Di (a) of the set ati (k, µ)q : (k, µ) ∈ Si , i = 1, . . . , 5, q we have max∗ Di (a) ≤ a∈Fq

log q max |σi (c)|. |Si | c∈F∗q

From Lemma 5 and (5) we obtain max∗ Di (a) = O(W 1/2 q 1/2−γ |M|−1 log q) a∈Fq

= O(q −γ/2 log q) = O(2− log

1/2

q

),

provided that q is suﬃciently large, i = 1, . . . , 5.

Similarly, from Lemma 6 we have a similar result for the NR scheme. Lemma 8. For any element g ∈ Fp of multiplicative order q the sequence 1/2 2−l r(k, µ), (k, µ) ∈ Fq × M, are 2− log q homogeneously distributed modulo q, provided that |M|2 q 3−γ U≤ . p3 for some γ > 0.

106

Edwin El Mahassni, Phong Q. Nguyen, and Igor E. Shparlinski

Proof. Let a be an integer with gcd(a, q) = 1. Let I ∈ [0, 1] be an interval. Then the condition −l a2 r(k, µ) q ∈I q

(8)

is equivalent to the congruence a2−l r(k, µ) ≡ qϑ + ρ

(mod p),

(9)

with some integer ρ such that ρ/q ∈ I and some integer ϑ such that 0 ≤ qϑ+ρ ≤ p − 1. Let L = (p − 1)/q and let the integer I be deﬁned is the length of the largest interval of the form J +1 J +I , ∈I q q with integer I. Thus I = q|I| + O(1). For each ﬁxed ϑ ∈ [0, L − 1] as before, from Lemma 2 we conclude that the number of pairs (k, µ) ∈ Fq × M satisfying (9) with ρ/q ∈ I is J+I 1 ep c 2−l r(k, µ) − qϑ − ρ p c∈Fp µ∈M k∈F∗ q ρ=J+1   J+I 1 |M|qI = +O |τ (c2−l )| ep (cρ) . p p ∗ c∈Fp

ρ=J+1

From Lemma 6 and the estimate J+I = O(p log p), e (cρ) p c∈F∗ ρ=J+1 p see Exercise 11.c of Chapter 3 of [23], we conclude that there are |M|q 2 |I| |M|qI + O U 1/2 p1/2 q 1/2 = + O U 1/2 p1/2 q 1/2 + |M|qp−1 p p such pairs (k, µ) ∈ Fq × M. For ϑ = L the only possible value of ρ is ρ = 0. Obviously for each µ ∈ M there is at most one value of k which satisﬁes the congruence a2−l r(k, µ) ≡ p − 1 (mod p), thus it holds for at most |M| pairs (k, µ) ∈ Fq × M. Putting everything together we see that (8) holds for |M|q 2 |I| L + O LU 1/2 p1/2 q 1/2 + L|M|qp−1 + |M| p = |M|q|I| + O U 1/2 p3/2 q −1/2 + |M|

The Insecurity of Nyberg–Rueppel and Other DSA-Like Signature Schemes

107

pairs (k, µ) ∈ Fq × M. One veriﬁes that U 1/2 p3/2 q −1/2 ≤ |M|q 1−γ/2 under the condition of the theorem and the result follows.

3 3.1

Lattice Attacks on DSA-Like Algorithms Main Results

DSA For i = 1, . . . , 5 and an integer we deﬁne the oracle Oi, which, for any given DSA signature (r(k), si (k, µ)), (k, µ) ∈ Si , returns the least signiﬁcant bits of k. Combining the inequality (3), Lemma 4 and Lemma 7, we obtain:

Theorem 1. Let Q be a suﬃciently large integer. The following statement holds with ν = 1/3 for all primes p ∈ [Q, 2Q], and with ν = 0 for all primes p ∈ [Q, 2Q] except at most Q5/6+ε of them. For i = 1, . . . , 5 and any ε > 0 there exists γ > 0 such that for any element g ∈ Fp of multiplicative order q ≥ pν+ε , and any hash function h with |M|2 W ≤ 1−γ , q DSA given an oracle Oi, with = log1/2 q + log log q, there exists a probabilisticpolynomial time algorithm to recover the signer’s DSAi secret key α, from O log1/2 q signatures (r(k), si (k, µ)) with k ∈ [0, q − 1] and µ ∈ M selected independently and uniformly at random. The probability of success is at least 1/2 1 − 2−(log q) log log q . For an integer we deﬁne the oracle ON R which, for any given DSA signature (r(k, µ), v(k, µ)), k ∈ Fq , µ ∈ M, returns the least signiﬁcant bits of k. Combining the inequality (4), Lemma 4 and Lemma 8, we obtain: Theorem 2. For any element g ∈ Fp of multiplicative order q ≤ p1−ε , any ﬁxed γ > 0 and any function H with |M|2 q 3−γ p3 given an oracle ON R with = log1/2 q + log log q, there exists a probabilistic polynomial time algorithm to recover the signer’s NR secret key α, from O log1/2 q signatures (r(k, µ), v(k, µ)) with k ∈ [0, q − 1] and µ ∈ M selected independently and uniformly at random. The probability of success is at least 1/2 1 − 2−(log q) log log q . U≤

As noticed previously, it is reasonable to expect that W is close to |M|2 /q so that the corresponding condition of Theorem 1 is almost always satisﬁed.

108

Edwin El Mahassni, Phong Q. Nguyen, and Igor E. Shparlinski

Furthermore, for the function H in the NR signature, in the most interesting case we have U = |M| thus the corresponding inequality of Theorem 2 takes the form |M| ≥ p3 q −3+γ . In particular, if the message set M is “dense” (that is, of order p) then Theorem 2 applies for q ≥ p2/3+γ . On the other hand, in almost all practical applications q is much smaller than this bound and it would be very interesting to extend Theorem 2 to smaller values of q. We remark that studying the NR scheme has turned out to be harder than studying the classical DSA scheme in [15] and its modiﬁcations DSAi , i = 1, . . . , 5, in this paper. The reason is that for the NR scheme the multiplier r(k, µ)q is not a product of two distinct quantities taken modulo q (although r(k, µ) is such a product taken modulo p this property is lost after reducing modulo q). Accordingly the technique of estimation of double exponential sums which is used in [15] and in this paper for DSAi , i = 1, . . . , 5 cannot be applied to the studying r(k, µ). Similar results can be obtained for other modiﬁcations of the DSA which are outlined in [12,18,19]. 3.2

Experimental Results

We experimented the attack with the NTL library [22]. The running time is less than half an hour for a number of signatures d less than a hundred, on a 500 MHz DEC Alpha. We used a 160-bit prime q, and a 512-bit prime q. For each choice of parameters size, we ran the attack several times on newly generated parameters (including the prime q and the multipliers of the DSA–HNP). The results are exactly the same as those obtained in [15]. The proof of Lemma 4 relies on the ability to approximate the closest vector problem in a lattice. Due to the well-known experimental fact that lattice reduction algorithms behave better than theoretically expected, it is in practice possible to obtain much better bounds than those of Lemma 4. In [15], it is shown that = 2 instead of roughly ≈ log1/2 q is suﬃcient for the attack to work, if ideal lattice reduction is assumed. Using Schnorr’s improved lattice reduction [21] to solve the closest vector problem in a lattice, we were always able to solve the DSA-like problems with = 3 and d = 100 (on more than 50 trials). We always failed with = 2 and d = 150, perhaps because current lattice basis reduction algorithms are more suited to the Euclidean norm than the inﬁnity norm. Finally, as in [15] we remark that one of the possible ways to obtain several most signiﬁcant bits of the nonce k is to use timing or power attacks and select signatures corresponding to small values of k, thus to values whose most signiﬁcant bits are zeros.

The Insecurity of Nyberg–Rueppel and Other DSA-Like Signature Schemes

109

References 1. M. Ajtai, R. Kumar and D. Sivakumar, A sieve algorithm for the shortest lattice vector problem, Proc. 33rd ACM Symp. on Theory of Comput., Crete, Greece, July 6-8, 2001 601–610. 2. L. Babai, On Lov´ asz lattice reduction and the nearest lattice point problem, Combinatorica, 6 (1986), 1–13. 3. D. Boneh and R. Venkatesan, Hardness of computing the most signiﬁcant bits of secret keys in Diﬃe–Hellman and related schemes, Lect. Notes in Comp. Sci., Springer-Verlag, Berlin, 1109 (1996), 129–142. 4. D. Boneh and R. Venkatesan, Rounding in lattices and its cryptographic applications, Proc. 8-rd Annual ACM-SIAM Symp. on Discr. Algorithms, ACM, NY, 1997, 675–681. 5. M. Drmota and R. Tichy, Sequences, discrepancies and applications, SpringerVerlag, Berlin, 1997. 6. N. A. Howgrave-Graham and N. P. Smart, Lattice attacks on digital signature schemes, Designs, Codes and Cryptography, (to appear). 7. R. Kannan, Algorithmic geometry of numbers, Annual Review of Comp. Sci., 2 (1987), 231–267. 8. S. V. Konyagin and I. E. Shparlinski, Character sums with exponential functions and their applications, Cambridge Univ. Press, Cambridge, 1999. 9. R. Kuipers and H. Niederreiter, Uniform distribution of sequences, Wiley-Interscience, NY, 1974. 10. A. K. Lenstra, H. W. Lenstra and L. Lov´ asz, Factoring polynomials with rational coeﬃcients, Mathematische Annalen, 261 (1982), 515–534. 11. R. Lidl and H. Niederreiter, Finite ﬁelds, Cambridge University Press, Cambridge, 1997. 12. A. J. Menezes, P. C. van Oorschot and S. A. Vanstone, Handbook of Applied Cryptography, CRC Press, Boca Raton, FL, 1996. 13. C. J. Moreno and O. Moreno, Exponential sums and Goppa codes, I, Proc. Amer. Math. Soc., 111 (1991), 523–531. 14. P. Q. Nguyen, The dark side of the hidden number problem: Lattice attacks on DSA, Proc. Workshop on Cryptography and Computational Number Theory, Singapore 1999, Birkh¨ auser, 2001, 321–330. 15. P. Q. Nguyen and I. E. Shparlinski, The insecurity of the Digital Signature Algorithm with partially known nonces, J. of Cryptology, to appear. 16. P. Q. Nguyen and J. Stern, The hardness of the hidden subset sum problem and its cryptographic implications, Lect. Notes in Comp. Sci., Springer-Verlag, Berlin, 1666 (1999), 31–46. 17. H. Niederreiter, Random number generation and quasi–Monte Carlo methods, SIAM, Philadelphia, 1992. 18. K. Nyberg and R. A. Rueppel, Message recovery for signature schemes based on the discrete logarithm problem, J. Cryptology, 8 (1995), 27–37. 19. B. Schneier, Applied cryptography, J. Wiley, NY, 1996. 20. C. P. Schnorr, A hierarchy of polynomial time basis reduction algorithms, Theor. Comp. Sci., 53 (1987), 201–224. 21. C. P. Schnorr and M. Euchner, Lattice basis reduction: improved practical algorithms and solving subset sum problems, Math. Programming, 66 (1994), 181–199. 22. V. Shoup, Number Theory C++ Library (NTL), Available at http://www.shoup.net/ntl/. 23. I. M. Vinogradov, Elements of number theory, Dover Publ., New York, 1954.

Dimension Reduction Methods for Convolution Modular Lattices Alexander May1 and Joseph H. Silverman2 1

2

Department of Mathematics and Computer Science University of Paderborn, 33095 Paderborn, Germany [email protected] NTRU Cryptosystems, Inc., 5 Burlington Woods, Burlington, MA 01803 USA and Mathematics Department, Brown University Providence, RI 02912 USA [email protected], [email protected]

Abstract. We describe a dimension reduction method for convolution modular lattices. Its eﬀectiveness and implications for parallel and distributed computing are analyzed. Keywords: Lattice reduction, cryptography, convolution modular lattice.

Introduction The theory of lattices provides a tempting source of hard problems for cryptography, because the linearity of lattice operations oﬀers speed advantages over cryptosystems based on other known hard problems. Two proposed cryptosystems based on (approximate) shortest and closest vector problems are GGH [4] and NTRU [6]. Unfortunately (for cryptographers), current lattice reduction methods such as LLL and its variants [11,12,13,18,19] are quite eﬀective at ﬁnding short vectors in lattices of moderate dimension. This renders the GGH cryptosystem impractical [17], since its public keys consist of a full basis for the lattice, so the key size is proportional to the square of the lattice dimension. The NTRU public key cryptosystem [6] and the related NSS signature scheme [7,8] overcome this diﬃculty by using a class of lattices in which an entire basis can be speciﬁed by a single vector. These convolution modular lattices are deﬁned using convolution products and reduction modulo q, and the resulting cryptosystems have key size that is proportional to n log q for a lattice of dimension n. Convolution modular lattices have a cyclic structure that makes them nice to use in cryptography, but that same structure is a potential liability, since it oﬀers an additional avenue for solving the underlying hard lattice problem. In this note we explore a method, originally proposed by the ﬁrst author [14,15], that exploits the cyclic structure in order to decrease the dimension of the underlying lattice. Since the solution time is roughly proportional to the dimension of the lattice, this oﬀers the possibility of signiﬁcant savings; and indeed in low dimensions, the method is fairly eﬀective. However, in higher dimensions such J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 110–125, 2001. c Springer-Verlag Berlin Heidelberg 2001

Dimension Reduction Methods for Convolution Modular Lattices

111

as those used in commercial implementations of NTRU [9], the speedup does not signiﬁcantly aﬀect basic security estimates. We also ﬁnd that although the dimension reduction method can be parallelized, the eﬀect is not linear in the number of processors.

1

Convolution Products and Convolution Modular Lattices

The convolution product of two vectors u = [u0 , u1 , . . . , uN −1 ] ∈ ZN

and

v = [v0 , v1 , . . . , vN −1 ] ∈ ZN

is the vector w = [w0 , w1 , . . . , wN −1 ] = u ∗ v whose k th coordinate is given by the formula wk = u0 vk + u1 vk−1 + · · · + uk v0 + uk+1 vN −1 + · · · + uN −1 vk+1 = ui vj . i+j≡k (mod N )

Convolution product makes the lattice ZN into a ring. In a similar manner, if we start with vectors whose coordinates are in the ﬁnite ﬁeld Fq , then convolution product makes the vector space FN q into a ring, and reduction modulo q gives N a natural ring homomorphism Z → FN q . In this note we will study certain sublattices of ZN that are deﬁned by convolution congruences. Remark 1. An alternative description of the convolution ring ZN is the polynomial quotient ring Z[X]/(X N − 1). Under this isomorphism, the vector v is identiﬁed with the polynomial v0 +v1 X +v2 X 2 +· · ·+vN −1 X N −1 . We will mainly use the vector description, but it is sometimes useful to deal with polynomials, especially when discussing the mod q multiplicative inverse of a vector. Let q ≥ 1 be an integer, which we will call the modulus, and let c ∈ ZN be a ﬁxed vector. The collection of pairs of vectors [u, v] ∈ Z2N satisfying the congruence c ∗ u ≡ v (mod q) (1) forms a lattice in Z2N . We denote this lattice by L(c, q) and call it the Convolution Modular Lattice (CML) associated to c and q. It is clear that L(c, q) is a lattice of dimension 2N , since directly from (1) we see that L(c, q) is a subgroup of Z2N and satisﬁes qZ2N ⊂ L(c, q) ⊂ Z2N . Using the formula for the convolution product, the lattice L(c, q) may be described very explicitly as the lattice spanned by the rows of the following

112

Alexander May and Joseph H. Silverman

matrix:

       L = L(c, q) = RowSpan       

1 0 ··· 0 1 ··· .. .. . . . . . 0 0 ··· 0 0 ··· 0 0 ··· .. .. . . . . .

0 0 .. .

c0 c1 cN −1 c0 .. .. . .

1 0 0 .. .

c1 q 0 .. .

0 0 ··· 0

0

· · · cN −1 · · · cN −2 . .. . .. c2 · · · c0 0 ··· 0 q ··· 0 .. . . . . . .. 0 ···

             

q

Remark 2. The N -by-N upper righthand block of the matrix for L(c, q) is the circulant matrix of the sequence [c0 , c1 , . . . , cN −1 ]. For this reason an alternative name for L(c, q) might be Circulant Modular Lattice. Remark 3. In typical cryptographic applications such as NTRU and NSS [6,7,8], convolution modular lattices are constructed to contain a particular short vector [a, b]. For example, a and b might be chosen from the set of binary (or trinary) vectors with a speciﬁed number of ones (and negative ones). The corresponding CML is given by the solutions [u, v] to the congruence b∗u ≡ a∗v

(mod q).

Equivalently, it is the lattice L(c, q) with c ≡ a−1 ∗ b (mod q). The public information is the generating vector c, and the secret information used as a trapdoor is the short vector [a, b].

2

The Shortest Vector Problem and the Closest Vector Problem in Convolution Modular Lattices

Two classical and much-studied problems in the theory of lattices are the shortest vector problem (SVP) and the closest vector problem (CVP). These are, respectively, the problem of ﬁnding a shortest nonzero vector in L and the problem of ﬁnding a vector in L that is closest to a given target vector t not lying in L. An overview of the theoretical study of these problems may be found in [3]. The practical problem of solving SVP and CVP has also attracted considerable attention. The LLL algorithm [13] and its improvements and variants (e.g., [11,12,18,19]) provide a practical method for ﬁnding moderately short and moderately close vectors, but the computation of shortest and closest vectors remains very diﬃcult from both a theoretical [1,16] and a practical perspective [2]. The standard notation for the length of a shortest nonzero vector in a lattice L is λ1 = λ1 (L) = min v : v ∈ L, v = 0}.

Dimension Reduction Methods for Convolution Modular Lattices

113

If t is any vector, we use a similar notation λ1 (t) = λ1 (t, L) = min t − v : v ∈ L} to denote the distance from t to a closest vector in L. In terms of theoretical complexity theory, CVP may be a little harder to solve than SVP (but see [5]). However, for most problems there appears to be very little diﬀerence in practice. More precisely, if (L, t) is an n-dimensional CVP to be solved, then one forms the (n + 1)-dimensional lattice L = {(v, 0) : v ∈ L} + {k(t, c) : k ∈ Z} ⊂ Rn+1 . For an appropriately chosen value of c, a shortest nonzero vector in L will often have the form (u, c), and then it is likely that the vector t − u (which is in L) will be a closest vector to t. See, e.g., [4,17] for further details. Example 1. Typical convolution modular lattices used in cryptography will contain short (probably shortest) vectors w = [u, v] that are binary or trinary of known form. For ease of exposition, we will consider the case of binary vectors, the trinary case being similar. For example, if we let BN (d) = {binary vectors with d ones and N − d zeros}, then an adversary may know that L(c, q) contains a vector w = [u, v] satisfying u, v ∈ BN (d). His objective is to ﬁnd this vector (or one of its rotations, see Section 3). The√ most straightforward approach is to solve SVP. The vector w has length w = 2d, so if w is a smallest vector than solving SVP will ﬁnd w. However, it will generally be easier to solve CVP with target vector

d d d d , , ,..., t= , N N N N since the distance from t to w satisﬁes 2d(N − d) √ < 2d = w . t − w = N More generally, the two halves of the shortest vector may have unequal sizes, say u ∈ BN (d1 ) and v ∈ BN (d2 ). In this case the lattice should be balanced before formulating the appropriate CVP. For ease of exposition, we will restrict attention in this note to the case that u = v , but see Section 5 for a brief discussion of the balancing process. Extensive experiments with convolution modular lattices using NTL’s implementation [10] of current lattice reduction methods have yielded the following result. Heuristic 1. Let L = {(L, t)} be a collection of pairs consisting of a convolution modular lattice L and a CVP target vector t, and suppose that the collection has the following properties:

114

Alexander May and Joseph H. Silverman

1. The ratio N/q is√(approximately) constant for the lattices in L. 2. The ratio λ1 (t)/ q is (approximately) constant for the lattices in L. 3. λ1 (t) is significantly smaller than N q/πe, say by at least a factor of 2. Then there are positive constants α and β so that the time required to solve the CVP for every (L, t) in L is given by log10 (Time) ≈ αN + β. In other words, the time to solve CVP is exponential in the dimension of the lattice. Remark 4. The key conditions in Heuristic 1 are conditions (1) and (2) requiring √ that N/q and λ1 (t)/ q be held approximately constant. Condition (3) is less important, it simply says that the lattice contains a vector that is signiﬁcantly closer to t than would have been predicted by the Gaussian heuristic. More precisely, the Gaussian heuristic suggests that a (random) lattice L of dimension n and discriminant D will generally have few vectors that are signiﬁcantly closer than the Gauss constant γ = γ(L) = D1/n n/2πe to a given vector t. See [6] or [9, Annex A.3.5] for further details of this observation. Remark 5. We can rephrase Heuristic 1 more intrinsically without direct reference to convolution modular lattices, although we do not know whether it holds for more general lattices. The Gaussian heuristic says that in a “random” lattice L, SVP and CVP have solutions of size approximately γ(L). Then the heuristic says that in a collection of (CML) lattices and target vectors satisfying γ(L) ≈ c1 dim(L)

and

γ(L) λ1 (t) ≈ c2 , dim(L)

the solution time is approximately exponential in the dimension of L. Example 2. A series of experiments on convolution modular lattice CVP’s (with 67 ≤ N ≤ 82) satisfying N ≈ 1.96 q

and

λ1 (t) √ ≈ 0.896 q

yielded a solution time log10 (Time) ≈ 0.083N − 7.5, where the time is measured in MIPS-years. (A MIPS-year is an approximate amount of computation that a machine capable of performing one million arithmetic instructions per second would perform in one year, about 3·1013 arithmetic instructions.) These values correspond to taking target binary vectors (as described in Example 1) in which each half of the target vector has approximately 0.287N ones and 0.713N zeros. Extrapolating to the higher value N = 251 gives a search time of approximately 2.1 · 1013 MIPS-years for target vector halves having 72 ones and 179 zeros.

Dimension Reduction Methods for Convolution Modular Lattices

3

115

Rotation Invariance of Convolution Modular Lattices

For any vector u = [u0 , u1 , . . . , uN −1 ], deﬁne the (right) rotation of u by ρ(u) = [uN −1 , u0 , u1 , . . . , uN −2 ]. (In terms of the polynomial ring Z[X]/(X N − 1) described in Remark 1, right rotation is simply multiplication by X.) Applying ρ several times gives a k-fold rotation, which we denote by u(k) = ρk (u) = [uN −k , uN −k+1 , . . . , uN −k−1 ]. An easy computation using the deﬁnition of the convolution product shows that ρ(u ∗ v) = u ∗ ρ(v), and repeated application of this rule gives ρk (u ∗ v) = u ∗ ρk (v)

for all k ∈ Z.

(Negative powers of ρ are deﬁned as left rotations.) Let L(c, q) be a CML. Applying ρk to the deﬁning congruence (1) for L(c, q) yields c ∗ ρk (u) ≡ ρk (v) (mod q), so we see that if [u, v] is in L(c, q), then every rotation [u(k) , v(k) ] is also in L(c, q). Note that the rotations of a vector have the same length as the original vector. In particular, the SVP for a CML will have up to N diﬀerent solutions corresponding to the N rotations of any one shortest vector. Similarly, if the target vector t ∈ Rn for a CML CVP is rotation invariant (i.e., has all of its coordinates the same), then the CVP will have up to N diﬀerent solutions, since if w ∈ L solves the CVP for t, then all of the rotations ρk (w) ∈ L will also solve the CVP for t. See Example 1 for a typical situation where this occurs.

4

The Pattern Method for Convolution Modular Lattices

The convolution lattices typically used in cryptography [6,7,8] are constructed to contain short binary (or trinary) vectors, which means in particular they tend to contain short vectors in which many of the coordinates are equal to zero. More precisely, they are constructed by choosing two short vectors a and b and taking the lattice L deﬁned by b∗u ≡ a∗v

(mod q).

(See Remark 3. The lattice L is the convolution modular lattice L(c, q) with c = a−1 ∗ b (mod q).) In this situation, the ﬁrst author [14,15] suggested looking for vectors [u, v] in L such that the ﬁrst r coordinates of u (or v) are all zero. The hope, of course, is that the generating vector [a, b] ∈ L has this property. If it does, then this method helps to eﬃciently ﬁnd it. More precisely, one multiplies the ﬁrst r

116

Alexander May and Joseph H. Silverman

columns of the matrix for L by a large constant θ, which has the eﬀect of biasing lattice reduction against nonzero coordinates in those columns. It is further noted in [14,15] that the method is more eﬀective for convolution modular lattices than for general lattices because of the rotation invariance inherent in a convolution modular lattice. Thus for a CML it is not necessary that a (or b) have its ﬁrst r coordinates zero, it suﬃces that the vector contains a string of r consecutive zeros somewhere in its list of coordinates. This is because L(c, q) also contains all of the rotations [a(k) , b(k) ] of each of its vectors, so if a (or b) contains a run of r consecutive zeros, then one of the rotations of [a, b] will have the zero run in the correct position. More generally, as noted by the authors and others, rather than choosing a run of r consecutive zeros, one can choose a random pattern of r coordinates and hope that L contains a short vector with the chosen pattern of zeros. And just as before, since the CML is rotation invariant, it suﬃces that the generating vectors have some rotation containing the preselected pattern of zeros. Even more generally, one might choose a pattern consisting of both zero and nonzero entries. We will call this the CML Pattern Method. For simplicity, we will concentrate in this note on patterns of zeros, but see Remark 8 for some brief comments on the more general situation. From a cryptographic viewpoint, it is clearly better to choose essentially random patterns. Thus if L(c, q) = L(a−1 ∗ b, q) is being used for cryptography, then the person who creates the lattice by choosing [a, b] can easily thwart any particular pattern (e.g., long runs of zeros) by discarding a and b if they contain the chosen pattern. There is a second, less obvious, reason why it is disadvantageous for an attacker to choose a pattern consisting of consecutive zeros. The attacker “wins” if the pattern of coordinates that he chooses corresponds to zero coordinates in any one of the shifts a(k) of the unknown vector a. Now it may happen that there are actually two diﬀerent shifts a(k1 ) and a(k2 ) that win. This means that L(c, q) contains two diﬀerent target vectors. In practice having two target vectors does not seem to help lattice reduction very much. (Indeed, underlying May’s original idea is taking the lattice L(c, q), which has N shortest vectors, and breaking the symmetry until there is only one shortest vector.) It turns out that multiple winners are more likely to occur if the attacker chooses consecutive coordinates than if he chooses random coordinates. Since the attacker’s goal is simply to choose a single winning set of coordinates, he does best if most winners are only single winners. Thus by choosing random coordinates, he will spread the winning entries more widely. We illustrate this last point with a small example. We take vectors of length N = 13 containing d = 4 non-zero entries. There are 715 such vectors. We consider various patterns and for each vector a we count how many times that pattern appears in some cyclic rotation of the coordinates of a. For example, if we take the pattern 1, 2, 3, 4, then we are counting how many times there are 4 consecutive zeros in a, while if we take 1, 3, 5, 8, we are counting how many times the vector a contains consecutive coordinates of the form 0#0#0##0. (Note that the coordinates of a wrap, so for example the vector a = (0, 1, 0, 1, 1, 1, 0) contains the pattern 1, 2, 4.) We write mk for the number of vectors in which

Dimension Reduction Methods for Convolution Modular Lattices

117

the given pattern appears k times. In particular, m0 is the number of vectors which contain no copies of the pattern. Thus in terms of guessing patterns, it is best to have m0 as small as possible. Table 1 gives the results of this experiment. Table 1. Multiplicity of Patterns — (N, d) = (13, 4). Pattern 1, 2, 3, 4, 5 1, 2, 6, 10, 12 1, 2, 4, 7, 11 1, 2, 3, 6, 10 1, 2, 5, 8, 10 1, 3, 5, 8, 9

m0 260 130 117 117 78 78

m1 195 299 338 338 377 377

m2 130 247 208 208 247 247

m3 78 39 52 52 13 13

m4 39 0 0 0 0 0

m5 13 0 0 0 0 0

Thus for vectors of length 13 containing 4 nonzero entries, the probability of containing the pattern 1, 2, 3, 4, 5, that is, the probability of containing ﬁve consecutive zeros, is (715 − 260)/715 = 64%. This is reasonably high, but notice that the probability of containing the pattern 1, 2, 4, 7, 11 is 84%, while the probability of containing the pattern 1, 2, 5, 8, 10 is 89%. It seems likely that the pattern 1, 2, . . . , r always gives the lowest probability. It would be interesting to try to prove this. In conclusion, it appears to be in the attacker’s best interest either to choose random coordinates or to do a further analysis and determine patterns which have particularly high probability of being successful. However, the disadvantage of choosing a particular pattern is that if the lattice creator knows which pattern(s) the attacker will use, he can always ensure that the shortest vectors in his lattices do not contain that pattern. Remark 6. It appears that there are some patterns that discourage multiple winners, just as a pattern of consecutive zeros appears to encourage multiple winner. More precisely, it seems that there are some patterns J with the property that if a(k) does not contain J for some given k, then it is more likely that other rotations will contain J. It seems to be a diﬃcult combinatorial problem to even quantify this precisely, and from a practical perspective, using randomly selected patterns appears to give reasonable performance. We formulate some natural questions and conjectures which we believe are of interest. – Conjecture. Among patterns of length r, the pattern J = [1, 2, . . . , r] of consecutive zeros gives the fewest distinct winners. – Question. What is the average number of distinct winners as J runs over all patterns of length r? – Question. What pattern (or patterns) J gives the maximum number of distinct winners?

118

5

Alexander May and Joseph H. Silverman

Balancing the Target in a Convolution Modular Lattice

Let L(c, q) be a CML that is constructed by setting c ≡ a−1 ∗ b (mod q) with short vectors a and b as described in Remark 3. If a and b have diﬀerent lengths, it may be easier to ﬁnd them by using a balanced CML. Given c, q and a real number λ, the associated λ-balanced CML is the lattice generated by the rows of the following matrix:   c0 c1 · · · cN −1 λ 0 ··· 0  0 λ · · · 0 cN −1 c0 · · · cN −2     .. .. . . .. ..  .. .. . .  . . . .  . . . .    0 0 ··· λ c1 c2 · · · c0   L(c, q, λ) = RowSpan   0 0 ··· 0 q 0 ··· 0     0 0 ··· 0 0 q ··· 0     .. .. . . .. .  .. .. . .  . . . . . . . ..  0 0 ··· 0 0 0 ··· q The real number λ is called the balancing constant. It is selected to make lattice reduction algorithms work more eﬃciently. More precisely, lattice reduction works best if we minimize the ratio between the length of the shortest vector and the length of the next shortest (independent) vector. [For a CML, [u , v ] is independent of [u, v] if it does not lie in the subspace generated by [u, v] and all of its rotations.] The shortest vector in L(c, q, λ) is probably the vector [λa, b], while the Gaussian heuristic predicts that the next shortest independent vector has length approximately dim L(c, q, λ) N qλ 1/ dim L(c,q,λ) · Disc(L(c, q, λ)) . = 2πe πe Thus we want to choose λ to minimize the ratio

λ2 a 2 + b 2 . N qλ/πe The optimal value is λ = b / a . Note that this equalizes the lengths of the two halves of the vector [λa, b]. Further, the fundamental ratio that inﬂuences the diﬃculty of lattice reduction is equal to

Length of shortest vector λ2 a 2 + b 2 2πe a b ≈ = . (2) Length of next independent vector N qλ/πe Nq Remark 7. In practice, one generally approximates the optimal value of λ with a rational number α/β ≈ λ satisfying gcd(α, q) = gcd(β, q) = 1. The balanced CML for the balancing constant α/β is the set of solutions [u, v] ∈ ZN to the congruence c ∗ βu ≡ αv (mod q).

Dimension Reduction Methods for Convolution Modular Lattices

6

119

Probability of CML Pattern Success

The CML Pattern Method will not work unless the lattice contains a vector with the selected pattern. It is thus important to calculate the probability that a random vector will contain a given pattern. For example, among all binary vectors of dimension 251 containing 72 ones, what is the probability that a randomly selected vector will contain a particular pattern of 17 zeros? As we have seen in Section 4, the exact probability will depend on the chosen pattern, but by making a certain independence assumption we can obtain a reasonable approximate formula. This estimate is given in the next result. Theorem 1. Fix positive integers N, d, r and a set of indices J = {j1 , j2 , . . . , jr } with 0 ≤ j1 < j2 < · · · < jr < N . Let BN (d) = {binary vectors of dimension N with exactly d ones} (a) Prob (aj1 = aj2 = · · · = ajr = 0) =

a∈BN (d)

N −r Nd d

=

d−1 i=0

r 1− N −i

.

(b) Prob

a∈BN (d)

N d−1 aj1 +k = aj2 +k = · · · = ajr +k = 0 r ≈ 1− 1 − 1− N −i for some 0 ≤ k < N i=0

(The indices on a = [a0 , a1 , . . . , aN −1 ] are taken modulo N .) Proof. (a) In order to create a vector a, we choose d coordinates of a equal to 1, and the others will be 0. There are Nd ways to do this. If we specify a particular set of r coordinates that are required to be 0, then there are only Nd−r possible choices for a. This proves the ﬁrst formula for the probability of success, and the second formula follows from a little bit of algebra. (b) For any particular k, the probability of success is given by the formula in (a). If we assume that the success probabilities for diﬀerent values of k are independent, then we can use the formula Prob(success for some k) = 1 − Prob(failure for every k) Prob(failure for k) =1− 0≤k
=1−

1 − Prob(success for k) .

0≤k
Substituting in the formulas from (a) completes the proof of (b), assuming that the diﬀerent k events are independent. (See Section 4 for a discussion on the extent to which the diﬀerent values of k give independent events. The precise amount of independence depends on the particular set of indices J.)

120

Alexander May and Joseph H. Silverman

In order to test the accuracy, on average, of Theorem 1, we performed experiments to compute the probability that an r-pattern wins in BN (d). For each r we ﬁxed a random vector a ∈ BN (d) and choose 10,000 random patterns of length r. The results, given in Table 2, show an excellent match between theory and experiment. Table 2. Probability that an r-Pattern Wins in BN (d). (N, d) = (167, 30)

r

15

20

25

30

35

40

45

Prob-Theory 0.999 0.913 0.533 0.204 0.063 0.017 0.004 Prob-Exp (N, d) = (251, 72)

r

1.000 0.918 0.534 0.209 0.059 0.017 0.004 5

10

15

20

25

30

35

Prob-Theory 1.000 1.000 0.734 0.189 0.031 0.005 0.001 Prob-Exp (N, d) = (347, 64)

r

1.000 1.000 0.731 0.188 0.032 0.004 0.001 20

25

30

35

40

45

50

Prob-Theory 0.995 0.823 0.432 0.166 0.056 0.017 0.005 Prob-Exp

0.995 0.834 0.426 0.167 0.059 0.017 0.005

Remark 8. As noted in Section 4, it may be advantageous to use patterns that contain nonzero entries, as well as zero entries. For example, suppose that a is a binary vector of dimension N with d ones and N − d zeros, and suppose that an attacker guesses a pattern of length r. The numbers N , d, and r are ﬁxed, but we are free to specify r1 ones and r0 zeros, where r1 + r0 = r. There are two issues to consider. First, it may be easier to guess a mixed pattern of ones and zeros. Second, the length of the associated CVP may be smaller using a mixed pattern. We brieﬂy consider these two issues. First consider the probability of guessing a correct pattern. If we take indices J = {j1 , . . . , jr0 } for the zeros and other indices L = {1 , . . . , r1 } for the ones, then the probability in Theorem 1(a) becomes

N −r

aj1 = aj2 = · · · = ajr0 = 0 and = d − r 1 . Prob a 1 = a 2 = · · · = a r 1 = 1 N a∈BN (d) d The attacker wants to maximize this probability. In order to maximize the probability of guessing correctly, he chooses a pattern of length r such that the diﬀerence of the number of zeros and the number of ones in the remaining N − r vector entries is minimal. Thus, the optimal choice is r1 =

r − (N − 2d) 2

and

r0 =

r + (N − 2d) , 2

(3)

Dimension Reduction Methods for Convolution Modular Lattices

121

but there is also the obvious restriction that r0 and r1 must be nonnegative. In particular, if d ≈ N/2, then he should take r1 ≈ r2 ≈ r/2. On the other hand, if d and r are small, more precisely if r + 2d ≤ N , then the best that the attacker can do is choose r1 = 0 and r0 = r, i.e., he should choose a pattern consisting entirely of zeros. Next consider the CVP that arises after a pattern has been correctly guessed. The fundamental length that appears in the associated CVP (see Example 1) is proportional to (d − r1 )(N − d − r0 ) , N −r so the attackers wants to choose r0 and r1 (subject to r0 + r1 = r) to minimize this quantity. But the choice made in (3) maximizes this function. If the attacker wants to make the CVP easiest, then he chooses a pattern of length r such that the diﬀerence between the number of zeros and the number of ones in the remaining N − r vector entries is maximal. For example, if he can guess all zeros or all ones in his pattern, he obtains length zero in the associated CVP. We will concentrate in this note on maximizing the probability of guessing correct patterns. It is an open question how to choose an optimal pattern that takes also the vector length in the associated CVP into account.

7

The Net Advantage of the CML Pattern Method

The eﬀect of the CML Pattern Method is to reduce the dimension of the search lattice. More precisely, a correct r-fold pattern has the eﬀect of reducing the eﬀective dimension from 2N to 2N − 2r. This can be quite signiﬁcant, since as explained in Section 2, the search time is roughly exponential in N . However, one does not know, a priori, that the given lattice has a vector with the given pattern. So balanced against the gain from the reduction in dimension is the loss from choosing a pattern that has no chance of working. Thus the eﬀective gain in eﬃciency is the probability of guessing a correct pattern multiplied by the reduction in search time. Proposition 1. Let L = {(L, t)} be a collection of pairs consisting of a convolution modular lattice L and a CVP target vector t. Suppose that there are constants α and β so that the time required to solve the CVP for each (L, t) ∈ L is given by log10 (Time) ≈ αN + β. Then the gain in applying the CML Pattern Method with a random set of indices J = j1 , j2 , . . . , jr is approximately Time to solve CVP in the original lattice Probability that the lattice · Gain = contains the pattern J of zeros Time to solve CVP in the J-eliminated lattice  N 

d−1 r  10αr ≈ 1 − 1 − (4) 1− N − i i=0

122

Alexander May and Joseph H. Silverman

The optimal value of r and approximate corresponding gain may be determined from the formula (4) once an experimental value of α is determined. Example 3. We use formula (4) to estimate the approximate gain in speed when the CML Pattern Method is applied to a lattice of dimension N = 251 with short vectors having d = 72. We use the value α = 0.083 from Example 2. The results are given in Table 3. We see that the optimal choice of r = 15 gives a speed gain of approximately 13. Table 3. Speed Gain for (N, d, α) = (251, 72, 0.083). r 1 2 3 4 5 6 7 8 9 10 Gain 1.21 1.47 1.77 2.15 2.60 3.15 3.81 4.61 5.58 6.76 r 11 12 13 14 15 16 17 18 19 20 Gain 8.16 9.71 11.22 12.36 12.90 12.79 12.14 11.12 9.92 8.66

8

Parallelization of the CML Pattern Method

The CML Pattern Method allows a partial parallelization of the CVP in convolution modular lattices. The basic idea is to have a large number of separate processors each choose a possible pattern and attempt to solve CVP using that pattern. The method is successful if any one machine guesses a pattern that appears in the solution vector. In a typical situation, one has a certain number of machines available and one wants to choose a value for r (the pattern length) in order to minimize the expected running time. An important observation is that for a ﬁxed value of r, the gain from adding more and more machines becomes less and less. This is due to the fact that it does not help the running time if more than one machine guesses a valid pattern. We now quantify these remarks. Let T (r) = time to run if we guess a valid pattern of length r, P (r) = probability of guessing a valid pattern of length r. Using one machine, the running time is more-or-less T (r)/P (r). Suppose we instead use two machines. If P (r) is small, the running time is approximately T (r)/2P (r), so we gain a factor of 2. But if P (r) is large, say 50%, then we save much less (on average), because there is a good chance that both machines will guess right the ﬁrst time, which doesn’t help. So suppose that we have K machines, each of which tries to guess a pattern of length r. Then the formula for the expected running time is given by the

Dimension Reduction Methods for Convolution Modular Lattices

123

following computation. total expected running time using K machines TotalTime(K, r) = and guessing patterns of length r T (r) = probability that at least one machine guesses correctly T (r) = 1 − probability that all machines guess wrong T (r) = 1 − (1 − P (r))K Notice that if P (r) is small (compared to 1/K), then we obtain TotalTime(K, r) ≈

T (r) , K · P (r)

which agrees with our intuition that using K machines gives a K-fold speedup. And as K gets very large with r ﬁxed, we ﬁnd that lim TotalTime(K, r) = T (r),

K→∞

which also makes sense, since if there are a huge number of machines, then at least one of them will almost certainly guess a valid pattern the ﬁrst time. Hence given access to K machines, the optimal strategy is to choose r so as the minimize the running time function TotalTime(K, r) =

T (r) . 1 − (1 − P (r))K

(5)

Letting rK denote this optimal value of r, we see that as a function of the number of machines K, the expected running time is given by the function TotalTime(K, rK ), a highly nonlinear function of K. In order to analyze parallelization more deeply, we thus need to know the functions T (r) and P (r). The formula for P (r) is given in Theorem 1(b). Further, as noted in Section 2, for certain classes of lattices it appears that the running time is exponential in the dimension of the lattice. Since use of a pattern of length r has the eﬀect of reducing the dimension by 2r (equivalently, reducing the value of N by r), it is reasonable to take T (r) to have the form T (r) = 10α(N −r)+β for certain constants α and β that are independent of r. However, we note that this neglects the fact that the length of the associated CVP problem is also reduced (see Remark 8), so the following computation is only a rough estimate. With this caveat, we consider the rough approximation TotalTime(K, r) =

T (r) ≈ 1 − (1 − P (r))K

1−

10α(N −r)+β

KN d−1 r 1− 1− N −i i=0

124

Alexander May and Joseph H. Silverman

and ask for the value rK of r that minimizes this function of K, treating α, β, d, and N as constants. Then the gain obtained by using K processors is approximately TotalTime(1, r1 ) . Gain(K) = TotalTime(K, rK ) It seems quite diﬃcult to obtain a closed form for this expression. We have estimated it numerically for the parameters (N, d, α, β) = (251, 72, 0.083, −7.5) and list the results in Table 4. (The value of β does not aﬀect the gain.) Table 4. Gain Using K Processors—(N, d, α, β) = (251, 72, 0.083, −7.5). K 1 2 3 5 10 20 50 75 100 150 200 300

rK 15 17 18 20 21 23 26 27 27 28 29 30

P (rK ) 0.734 0.471 0.357 0.189 0.135 0.066 0.021 0.015 0.015 0.010 0.007 0.005

K · P (rK ) 0.73 0.94 1.07 0.95 1.35 1.32 1.07 1.10 1.46 1.49 1.35 1.37

TotalTime(rK ) 1.6698 · 1012 1.1607 · 1012 9.4145 · 1011 7.2489 · 1011 5.0929 · 1011 3.5717 · 1011 2.2631 · 1011 1.8491 · 1011 1.6044 · 1011 1.3151 · 1011 1.1376 · 1011 9.3382 · 1010

Gain(K) 1.000 1.439 1.774 2.303 3.279 4.675 7.378 9.030 10.408 12.697 14.678 17.881

The numbers in Table 4 are puzzling at ﬁrst, since as noted above, if P (r) is small, then we expect the gain to be approximately K. However, this will only be true if K ≈ KP (r), (6) 1 − 1 − P (r) so in particular P (r) must be considerably smaller than 1/K. But in Table 4, the optimal choice of P (r) is approximately equal to 1/K, so the approximation (6) is not at all accurate.

References 1. M. Ajtai, The shortest vector problem in 2 is NP-hard for randomized reductions, Proc. 30th ACM Symposium on the Theory of Computing, pages 10-19, 1998 2. M. Ajtai, R. Kumar, D. Sivakumar, A sieve algorithm for the shortest lattice vector problem, Proc. 33rd ACM Symposium on Theory of Computing, 2001 (to appear) 3. J.W.S. Cassels, An Introduction to the Geometry of Numbers, Die Grundlehren Der Mathematischen Wissenschaften, Springer-Verlag, 1959. 4. O. Goldreich, S. Goldwasser, S. Halevi, Public-key cryptography from lattice reduction problems, CRYPTO’97, Lect. Notes in Computer Science 1294, SpringerVerlag, 1997, 112-131.

Dimension Reduction Methods for Convolution Modular Lattices

125

5. O. Goldreich, D. Micciancio, S. Safra and J.P. Seifert, Approximating shortest lattice vectors is not harder than approximating closest vectors, Information Processing Letters, vol. 71, pp. 55-61, 1999. 6. J. Hoﬀstein, J. Pipher, J.H. Silverman, NTRU: A new high speed public key cryptosystem, in Algorithmic Number Theory (ANTS III), Portland, OR, June 1998, Lecture Notes in Computer Science 1423 (J.P. Buhler, ed.), Springer-Verlag, Berlin, 1998, 267–288. 7. J. Hoﬀstein, J. Pipher, J.H. Silverman, NSS: An NTRU Lattice-Based Signature Scheme, Advances in Cryptology—Eurocrypt 2001, Lecture Notes in Computer Science, Springer-Verlag, 2001. 8. J. Hoﬀstein, J. Pipher, J.H. Silverman, The NTRU Signature Scheme: Theory and Practice, preprint, June 2001. 9. IEEE P1363.1, Standard Speciﬁcation for Public-Key Cryptographic Techniques Based on Hard Problems over Lattices, Draft 2, 2001. 10. Number Theory Library, Victor Shoup, http://www.cs.wisc.edu/~shoup/ntl 11. H. Koy, C.-P. Schnorr, Segment LLL-Reduction of Lattice Bases, Cryptography and Lattice Conference (CaLC 2001), Lecture Notes in Computer Science, SpringerVerlag, this volume. 12. H. Koy, C.-P. Schnorr, Segment LLL-Reduction with Floating Point Orthogonalization, Cryptography and Lattice Conference (CaLC 2001), Lecture Notes in Computer Science, Springer-Verlag, this volume. 13. A.K. Lenstra, H.W. Lenstra Jr., L. Lov´ asz, Factoring polynomials with rational coeﬃcients, Mathematische Ann. 261 (1982), 513-534. 14. A. May, Auf Polynomgleichungen basierende Public-Key-Kryptosysteme, Johann Wolfgange Goethe-Universitat, Frankfurt am Main, Fachbereich Informatik. (Masters Thesis in Computer Science, 4 June, 1999; Thesis advisor C.P. Schnorr). 15. A. May, Cryptanalysis of NTRU-107, preprint, April 1999 (unpublished). 16. D. Micciancio, The Shortest Vector in a Lattice is Hard to Approximate within Some Constant, Proc. 39th IEEE Symposium on Foundations of Computer Science, pages 92-98, 1998 17. P. Nguyen, Cryptanalysis of the Goldreich-Goldwasser-Halevi Cryptosystem, Advances in Cryptology - Proceedings of CRYPTO ’99, M. Wiener (ed.), Lecture Notes in Computer Science, Springer-Verlag, 1999. 18. C.P. Schnorr, M. Euchner, Lattice basis reduction: improved practical algorithms and solving subset sum problems, Math. Programming 66 (1994), no. 2, Ser. A, 181-199. 19. C.P. Schnorr, A hierarchy of polynomial time lattice basis reduction algorithms, Theoretical Computer Science 53, pages 201-224, 1987

Improving Lattice Based Cryptosystems Using the Hermite Normal Form Daniele Micciancio Department of Computer Science and Engineering University of California, San Diego 9500 Gilman Drive, La Jolla, CA 92093, USA [email protected]

Abstract. We describe a simple technique that can be used to substantially reduce the key and ciphertext size of various lattice based cryptosystems and trapdoor functions of the kind proposed by Goldreich, Goldwasser and Halevi (GGH). The improvement is signiﬁcant both from the theoretical and practical point of view, reducing the size of both key and ciphertext by a factor n equal to the dimension of the lattice (i.e., several hundreds for typical values of the security parameter.) The eﬃciency improvement is obtained without decreasing the security of the functions: we formally prove that the new functions are at least as secure as the original ones, and possibly even better as the adversary gets less information in a strong information theoretical sense. The increased eﬃciency of the new cryptosystems allows the use of bigger values for the security parameter, making the functions secure against the best cryptanalytic attacks, while keeping the size of the key even below the smallest key size for which lattice cryptosystems were ever conjectured to be hard to break. Keywords: Lattices, trapdoor functions, public-key encryption.

1

Introduction

Recent results on the complexity of lattices [1] have drawn considerable attention to lattice problems as potential candidates to design cryptographic primitives, and encryption schemes in particular. The two most notable proposals are the Ajtai-Dwork cryptosystem (AD, [2]) and the Goldreich-Goldwasser-Halevi cryptosystem (GGH, [14]). Other lattice based cryptosystems designed along the lines of [2,14] were subsequently proposed by Fischlin and Seifert [10] and Cai and Cusick [6]. While the AD cryptosystem is mainly of theoretical interest, the GGH cryptosystem was suggested as a practical alternative to number theory based schemes currently in use (e.g., the RSA cryptosystem [28]). Two other related cryptosystems are McEliece’s [21] and NTRU [17]. Neither of them is a lattice based cryptosystem in the strict meaning of the term, as they use ideas from other areas of mathematics (polynomial ring and ﬁnite

Research supported in part by NSF Career Award CCR-0093029.

J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 126–145, 2001. c Springer-Verlag Berlin Heidelberg 2001

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

127

ﬁeld arithmetic respectively). However, the security of NTRU is related to the hardness of certain lattice problems (see Section 7 for further discussion), and it deﬁnitely deserves a mention as the most practical of the above proposals, yielding keys of size O(n log n) instead of the Ω(n2 ) key size of McEliece, GGH and related schemes. (In fact, we’ll see that GGH keys can be as big as O(n3 log n).) McEliece’s scheme is based on the hardness of coding theoretic problems, rather than lattices, but it bears much resemblance to the GGH cryptosystem, and we will further discuss this scheme in Section 7, after introducing our new lattice based trapdoor function. As is the case for RSA, no proof of security for the GGH cryptosystem (or any of the aforementioned schemes with the only exception of Ajtai and Dwork’s theoretical proposal) is currently known, and its conjectured security is based on the empirical evidence that certain lattice problems are hard. In the attempt of stimulating further cryptanalytic eﬀorts against their system and determining appropriate key size, the authors of GGH published ﬁve numerical challenges [13] corresponding to increasing values of the security parameter n = 200, 250, 300, 350, 400, resulting in public key sizes ranging from 330 KB to over 2 MB. Despite the big key size even for the smallest dimension (330 KB), this cryptosystem was still competitive with number theoretic cryptosystems because the encryption time is essentially linear in the size of the key, while modular exponentiation typically requires O(n3 ) operations. At the time the GGH cryptosystem was presented at Crypto’97, challenges in dimension n = 150 were known to be breakable [31] using lattice reduction techniques. Still these techniques did not seem to apply to lattices in higher dimension n > 200. At Crypto’99 Nguyen [24] showed how to exploit a weakness speciﬁc to the way the GGH challenges were chosen and break the ﬁrst four of the ﬁve GGH challenges. As the only unbroken challenge had key size over 2 MB, the practical value of the GGH cryptosystem (and variants) seemed quite questionable and [24] concluded that “unless major improvements are found, latticebased cryptography cannot provide a serious alternative to existing public-key encryption algorithms.” In this paper we present one such improvement. Although quite simple, the techniques described in this paper can be used to signiﬁcantly reduce the key size of GGH-like cryptosystems (e.g., those presented in [14,10]). In particular, we show how to build lattice based trapdoor functions with public keys of size below 330 KB, and still secure against the best known lattice attacks. The improvement gets even better as the dimension of the lattice grows: our techniques can be used to asymptotically reduce the key size from O(n3 log n) to O(n2 log n). The improvement in the encryption time is analogous, being roughly proportional to the size of the public key, and the size of the ciphertext is also signiﬁcantly reduced going from O(n2 log n) to O(n log n). Surprisingly, we can achieve these eﬃciency improvements without decreasing the security of the scheme: any attack to the new scheme can be provably transformed into an (at least) equally eﬀective attack against the original GGH (and variant) schemes. The increased eﬃciency allows one to use greater values of the security parameter than considered in [14] and [24], while maintaining

128

Daniele Micciancio

the scheme reasonably practical. In particular, our techniques give encryption schemes that resist the best known lattice attacks and still have public keys even smaller than the weakest of the GGH challenges, bringing the feasibility of lattice based cryptography back into discussion. The rest of the paper is organized as follows. In Section 2 we recall some basic deﬁnitions and properties of lattices. In Section 3 we describe the original GGH scheme and discuss its weaknesses. In Section 4 we deﬁne a new cryptographic function that signiﬁcantly improves the GGH scheme both in terms of security and eﬃciency. The new scheme is analyzed in Section 5. To be precise, the GGH scheme, as well as the new one we are proposing in this paper, should be considered as trapdoor functions instead of ready-to-use encryption schemes. The reason is explained in Section 6, where we also discuss how to transform these functions into encryption schemes. In Section 6 we also describe some cryptanalytic experiments that we performed to validate our theoretical results. The McEliece and NTRU cryptosystems are discussed in Section 7. Section 8 concludes with ﬁnal remarks and open problems.

2

Preliminaries

m Let B = {b1 , . . . , bn } be a set of n linearly independent vectors in R . The lattice generated by B is the set L(B) = { i xi bi | xi ∈ Z} of all integer linear combinations of the vectors in B. The set B is called basis and it is usually identiﬁed with the matrix B = [b1 , . . . , bn ] ∈ Rm×n having the vectors bi as columns. In matrix notation L(B) = {Bx | x ∈ Zn }. The lattice L(B) is full rank if n = m, i.e. if B spans the entire vector space Rm over the reals. For simplicity, in the rest of this paper we will consider only full rank lattices. Moreover, for computational purposes, we will assume the basis vectors bi ∈ Zn have integer entries. Then, a basis is just a non-singular integer matrix B ∈ Zn×n . The basis of a lattice is not unique. A particularly convenient basis for some applications is the Hermite Normal Form (HNF). A basis B is in HNF if it is upper triangular, all elements on the diagonal are strictly positive, and any other element bi,j satisﬁes 0 ≤ bi,j < bi,i . It is easy to see that every integer lattice L(B) has a unique basis in Hermite Normal Form, denoted HNF(B). Moreover, given any basis B for the lattice, HNF(B) can be eﬃciently computed (see [23] for a recent algorithm and a survey of previous results). Notice that HNF(B) does not depend on the particular basis B with started from, and it is uniquely deﬁned by the lattice L(B) generated by B. For every basis B, the orthogonalized basis B ∗ = [b∗1 , . . . , b∗n ] is deﬁned by the usual Gram-Schmidt orthogonalization process:

b∗1 = b1 b∗i = bi −

bi , b∗j j
b∗j , b∗j

b∗j .

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

129

Notice that B ∗ is a basis for the vector space Rn , but is not in general a lattice basis for L(B). If B is in HNF, then B ∗ is simply the diagonal matrix with b1,1 , . . . , bn,n on the diagonal. The determinant of a lattice L(B) is the absolute value of the determinant of the matrix B. The determinant is a lattice invariant, i.e. it does not depend on the particular choice of the basis B. If B is in HNF, then the determinant det(B) is just the product of the elements on the diagonal n i=1 bi,i . An important property of integer lattices is that if two vectors v and w are congruent modulo det(B) (i.e. det(B) divides vi − wi for all i), then v ∈ L(B) if and only if w ∈ L(B). In other words, the lattice repeats identically if translated by multiples of det(L) along the direction of any of the main axes. The distance between two vectors v and w is deﬁned by dist(v, w) = v − w = (vi − wi )2 . i

The distance function is extended to sets of vectors as usual dist(S1 , S2 ) = inf{ v − w : v ∈ S1 , w ∈ S2 } . In particular the distance of a vector from a lattice is given by dist(v, L(B)) = min{ v − w : w ∈ L(B)}. In the closest vector problem (CVP), one is given a basis B and a target vector v (usually not in the lattice) and must ﬁnd the lattice vector in L(B) closest to v. CVP was proved NP-hard in [36], and it remains hard even if the lattice basis can be arbitrarily preprocessed [22], or 1− one allows for approximate solutions with approximation factor 2lg n [3,9]. To date, the best polynomial time algorithm to approximate CVP achieves only a worst case approximation factor which is almost exponential in the dimension of the lattice [19,4,29]. A closely related problem is the shortest vector problem (SVP): given a lattice L = L(B), ﬁnd the length λ(L) of the shortest non-zero vector in L(B). By linearity, λ(B) equals the minimum distance between any two lattice points min{ v − w : v, w ∈ L(B), v = w}. It is easy to see that for any vector v (not necessarily in the lattice) there exists at most one lattice point within distance λ/2 from v. One can easily show that the length of the shortest vector in a lattice L = L(B) satisﬁes λ(L) ≥ mini b∗i . Moreover, given a vector v within distance ρ = 12 mini b∗i from the lattice, the (unique) lattice vector within distance ρ from v can be eﬃciently computed from B and v using Babai’s nearest plane algorithm [4]. (See also [18].)

3

The GGH Encryption Scheme

The GGH encryption scheme [14] works essentially as follows. The private and public keys of the scheme are two bases B, R of the same lattice L = L(B) = L(R). The private key R is an exceptionally good basis. In particular, R is chosen in such a way that the quantity ρ = 12 min ri∗ is relatively large, so that all

130

Daniele Micciancio

errors of length less than ρ can be eﬃciently corrected using R. However, given the public basis this same task should be computationally hard. In particular, 1 ∗ 2 min bi is much smaller than ρ. The two bases are used to deﬁne a trapdoor function that takes as input an integer vector x and an error vector r of length at most ρ, and returns the vector c = Bx + r, i.e. the lattice vector with public coeﬃcients x perturbed by a small additive error r. Notice that Bx can be recovered from c using the private basis R. Once Bx is recovered, one can easily compute x and r using simple linear algebra, therefore inverting the function. A message m is “encrypted” by ﬁrst encoding m in the input (x, r), and then applying the trapdoor function to (x, r). Two encoding method are considered in [14]: 1. In the ﬁrst method, the message m is encoded in the error vector r, and x is chosen at random 2. In the second method, the message m is encoded in the coeﬃcients x, and r is chosen at random. For concreteness, in the rest of the paper we will assume the ﬁrst encoding method, but most of the techniques we describe can be easily adapted to the second method as well. In order to fully specify the trapdoor function the following questions must be answered: private basis R chosen? public basis B obtained from R? random vector x chosen? error vector r chosen? √ The authors of [14] suggest1 to take R = n · I + Q, where I is the identity matrix, and Q is a random perturbation matrix with entries in {−4, . . . , +4}. Then obtain the public basis B applying a suﬃciently long sequence of random elementary column operations to R. Then the message m is “encrypted” by encoding it in an error vector r with entries ri = ±3, and adding it to a lattice vector Bx chosen at random from a suﬃciently large region of space. Notice that in order to avoid attacks based on exhaustive search, the sequence of operations applied to R to obtain the public basis, and the region of space from which the lattice vector Bx is chosen must be suﬃciently large. Since the lattice repeats identically if translated by det(L) along any of the main axes, we can always assume that the entries of B and x are reduced modulo det(L) without decreasing the security of the scheme. We can use this observation to estimate the proper size of the public key B and the ciphertext c = Bx + r as O(n2 · lg(det(L))) and O(n · lg(det(L))). The determinant det(L) can also be estimated to be 2O(n lg n) applying Hadamard inequality to the private basis, 1. 2. 3. 4.

1

How How How How

is is is is

the the the the

These are the choices used to generate the challenges in [13] and considered in cryptanalytic attacks [24]. In fact a broader range of possible choices is considered in the paper [14].

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

131

resulting in O(n3 lg n) and O(n2 lg n) estimates for the key and ciphertext size. At this point one can point out how the particular way questions 1-4 were answered in [13] introduced some serious weakness in the system. In fact: 1. The only property of R required for the decryption algorithm to work is that ∗ the orthogonalized √ vectors ri are suﬃciently long. Choosing them to be close to the main axes n·ei seems a quite peculiar restriction that might make the scheme much weaker. Other work in the design of lattice based encryption schemes [35,10] suggests that rotations might play a fundamental role in making these schemes secure. 2. The size of the GGH challenges published at [13] are about an order of magnitude smaller than what we estimated to be the proper size. This suggests that the public key of the GGH challenges had not been “randomized” enough, making them particularly easy to break. 3. The same arguments apply to the choice of the lattice vector Bx. 4. Choosing error vectors whose entries have all the same absolute value also introduces serious weaknesses, as shown in [24]. Now it shouldn’t be a surprise that the numerical challenges in [13] have been broken, but it should also be clear that known attacks say very little about the general methodology used by the GGH cryptosystem. In particular, Nguyen attack [24] relies, in an essential way, on the property that all the entries in the error vector have the same absolute value and is based on the following observation: if all entries of r have absolute value σ, then c + s ≡ Bx (mod 2σ), where s is the vector [σ, . . . , σ]T . This allows to ﬁnd x modulo 2σ and reduce the problem of ﬁnding a lattice vector within distance r from c to the problem of ﬁnding a lattice vector within smaller distance r /(2σ) from (c − B(x mod 2σ))/(2σ). (In the GGH challenges σ = 3, reducing the length of the error by a factor 6.) As already noted in [24], removing the restriction that all entries in the error vector have the same modulus, immediately ﬁxes the problem, and the main question is whether the security parameter in the GGH scheme can be made suﬃciently large to achieve security, and maintaining the scheme practical at the same time.

4

An Optimal GGH-Like Trapdoor Function

We ﬁrst describe a general scheme to deﬁne GGH-like trapdoor functions, of which GGH is a special case. Then we show how to instantiate the scheme in an essentially optimal way, deﬁning a speciﬁc trapdoor function that is both more secure and eﬃcient than any other function from the scheme. In particular, the new trapdoor function is considerably more eﬃcient than the original GGH. Fix a probability distribution on the set of private bases R and let ρ be a correction radius such that using R one can correct any error of length less than ρ. (e.g. ρ = 12 mini ri∗ .) We deﬁne a family of functions fβ,γ parametrized by two algorithms β and γ as follows.

132

Daniele Micciancio

1. Let β be a (possibly randomized) function that on input a matrix R outputs another basis B for the same lattice that will be used as a public key. 2. γ is a (possibly randomized) function that on input the public basis B and an error vector r, outputs the coeﬃcients x of a lattice point Bx to be added to the error vector. 3. Let fβ,γ be the (possibly randomized) function with domain the set of vectors shorter than ρ deﬁned as follows: fβ,γ (r) = Bx + r where B = β(R) and x = γ(B, r). Notice that if the input r has length less then ρ, then the basis R can be used to ﬁnd the lattice point Bx closest to fβ,γ (r) and recover r. Therefore, for any ﬁxed β and γ, the probability distribution on R deﬁnes a family of trapdoor functions fβ,γ with public key (B, ρ) and trapdoor information R. The GGH trapdoor function can be deﬁned as a special case of this scheme when β(R) applies a sequence of elementary random operations to R, and γ(B, r) outputs an integer vector x chosen at random from a suﬃciently large region of space. We are now ready to deﬁne diﬀerent β and γ, that greatly increase both the security and the eﬃciency of the scheme. The idea is to replace the random choice of the public basis B and vector x with deterministic choices that can be formally proved to be optimal from the security point of view. In the following subsections we ﬁrst give some deﬁnitions that will be useful in the sequel, then show how to compute the public basis, and ﬁnally deﬁne the new trapdoor function. 4.1

Reducing Vectors Modulo a Basis

Every lattice L = L(B) induces an equivalence relation over Zn deﬁned as follows: v ≡L w if and only if v − w ∈ L. It is easy to see that for every n , there exists a unique point w in the orthogonalized parallelepiped point v ∈ Z ∗ P(B ) = { i xi b∗i | 0 ≤ xi < 1} such that w ≡L v. Vector w can be easily computed from v and B as follows. For all i = n, . . . , 1 (in decreasing order), v,b∗ let αi = b∗ ,bi∗ the component of v along b∗i and subtract αbi from v. Let w i i the ﬁnal result. Since w and v diﬀer only by integer multiples of basis vectors, w,b∗ we have w ≡L v. Moreover, it is easy to check that b∗ ,bi∗ ∈ [0, 1) for all i, and i i therefore w ∈ P(B ∗ ). The unique element of P(B ∗ ) congruent to v modulo L is denoted v mod B. Notice that although the equivalence relation v ≡L w does not depend on the particular choice of the basis B for the lattice L = L(B), the deﬁnition of the reduced vector (v mod B) is basis dependent. Pictorially, we can think the vector space Rn as partitioned into parallelepipeds {P(B ∗ ) + z | z ∈ L(B)}. Then, the reduced vector v mod B is the relative position of v in the parallelepiped P(B ∗ ) + z it belongs to. Notice

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

133

that if v is an integer vector, then also v mod B is an integer vector. Therefore the function x → (x mod B) deﬁnes a function from Zn to P(B ∗ ) ∩ Zn . If B is in Hermite Normal Form, then w = v mod B is an integer vector n satisfying 0 ≤ wi < bi,i . In particular w can be represented using roughly i=1 lg bi,i = lg(det(L)) bits. This representation is essentially optimal because ≡L induces exactly det(L) congruence classes on Zn . 4.2

Choosing the Public Basis

Let’s consider the choice of the public basis. The private basis R we start from is an exceptionally good basis that allows to solve the closest vector problem in the lattice L(R) and consequently decrypt messages. We would like to transform it into another basis for the same lattice L that gives the least possible amount of information about R. Instead of computing B by applying a complex random transformation to R, we set the public key of the new cryptosystem to be the Hermite Normal Form B = HNF(R) of R. Since the HNF(R) depends solely on the lattice L(R) generated by R (and not on the the particular basis R we used to compute it), the new public key gives no information about the private key R, other then the lattice L it generates. More formally, one can prove that any information about R that can be eﬃciently computed from B = HNF(R) can also be eﬃciently computed starting from any other (possibly random) basis B . This is because if B and R generate the same lattice L = L(B ) = L(R) then B = HNF(B ) = HNF(R) and B can be eﬃciently computed from B . 4.3

Adding a “Random” Lattice Point

Let’s now look at how to simulate the addition of a “random” lattice vector Bx to the error vector r. Ideally, we would like Bx to be a uniformly chosen vector from L. Unfortunately this is neither a computationally feasible nor a mathematically well deﬁned operation. However, we notice that we can achieve exactly the same result by mapping the error vector r to its equivalence class [r]L modulo ≡L . An eﬃcient way to do this is to use the reduced vector r mod B as a representative for this class. So, instead of adding to r a random lattice point Bx, we reduce r modulo the public basis B to obtain the ciphertext c ∈ P(B ∗ ). The new trapdoor function is then deﬁned as follows: f (r) = r mod B where B = HNF(R) is the Hermite Normal Form of the trapdoor information R. The triangular form of B also makes the trapdoor function (i.e., the reduction modulo B) extremely simple. Given r, the reduced vector r mod B can be easily determined as follow. Compute the integer vector x one coordinate at a time (starting from xn ) using the formula ri − j>i bi,j xj xi = . bi,i

134

Daniele Micciancio

The output of the trapdoor function is c = r − Bx ≡ r mod B. The reader can easily check that for every i, 0 ≤ ci < bi,i , i.e., the result is the unique point in the parallelepiped P(B ∗ ) = {w | 0 ≤ wi < bi,i } which is congruent to r modulo L(B). 4.4

The New Trapdoor Function

We now put all pieces together and deﬁne the new trapdoor function. Let R be a private basis chosen in such a way that ρ = 12 mini ri∗ is relatively big (see Fig. 1). The public basis B is the Hermite Normal Form of R (see Fig. 2). One can see that the public basis B and the corresponding orthogonalized parallelepiped P(B ∗ ) are very skewed. The public basis B deﬁnes a function with domain the set of vectors of length at most ρ (the shaded circle in Fig. 2). The result of applying the function to vector r is the point (r mod B) in the parallelepiped P(B ∗ ) congruent to r modulo the lattice. Notice that even if we always start from a vector r close to the origin, the result of performing the reduction operation is a point of P(B ∗ ) possibly closest to some other lattice point (see black regions in Fig. 2 and the corresponding closest lattice points). Notice that recovering the input vector r from f (r) involves ﬁnding the lattice point closest to f (r), which is conjectured to be infeasible using only the public basis B. However the lattice vector closest to r mod B can be computed using the private basis R as discussed in Section 2 because dist(f (r), L) = dist(r, L) ≤ ρ. Fig. 3 shows the orthogonalized parallelepipeds P(R∗ ) centered at every lattice point. Notice that the lattice point closest to f (r) (i.e., any point of the black regions in the picture) is just the center of the parallelepiped P(R∗ ) containing f (r), which can be found using the private basis R.

r 1 = r 1* ρ

r2 r *2

Fig. 1. A good lattice basis and the corresponding correction radius.

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

135

b2

1111 0000 0000 1111 0000 1111 0000 1111 0000 1111 0000 1111

b1

Fig. 2. HNF basis and corresponding orthogonalized parallelepiped.

r 1*

r *2

Fig. 3. Correcting small errors using the private basis.

5

Analysis

In this section we discuss the security and performance of the new scheme. 5.1

Security

We want to prove that the new trapdoor function f (r) is at least as secure as the original GGH function. We actually prove that f (r) is at least as secure as any GGH-like function fβ,γ as deﬁned in the previous section. Theorem 1. For any (eﬃciently computable) functions β, γ, and for any (eﬃcient) algorithm that on input f (r) ﬁnds some partial information about r with non-trivial probability, there exists an eﬃcient algorithm that on input fβ,γ (r) ﬁnds the same partial information with the same success probability.

136

Daniele Micciancio

Proof. The proof is a simple reduction argument. Assume A is an algorithm that breaks f . We show how to attack fβ,γ using A as a subroutine. We are given public basis B = β(R) and a ciphertext c = B · γ + r. The task is to ﬁnd (some partial information about) r. We ﬁrst compute B = HNF(B) and c = c mod B . Notice that B = HNF(R) and c = (Bγ + r) mod B = r mod B . Therefore B and c have the right distribution for algorithm A. Running A on B and c we will recover (the partial information about) r with the same success probability as A. 5.2

Space Eﬃciency

We now analyze the size of the keys and the ciphertext of the new encryption algorithm. We assume that the private key satisﬁes |ri,j | < poly(n). Therefore the size of the private key can be bounded by O(n2 lg n). Using the Hadamard inequality we can also bound the size of the determinant by O(n lg n), and using the bounds proved in Section 3, we get that also the public basis is O(n2 lg n) and the ciphertext has size O(n lg n). Estimates of the key and ciphertext sizes for the GGH and the modiﬁed scheme are shown in Fig. 1. The estimates are based on the GGH challenges published at [13]. Notice that the size of the GGH challenges is much smaller than it should have been to assure adequate randomization. This discrepancy might be explained noticing the the authors of GGH applied the LLL reduction algorithm to the public basis to somehow reduce their size. Nevertheless, the new scheme results in keys and ciphertexts more than an order of magnitude smaller than GGH. We remark that the sizes relative to the modiﬁed scheme are only upper bounds obtained using the Hadamard inequality to estimate the determinant of the lattice, and the actual sizes of the keys and ciphertexts of the modiﬁed cryptosystem can be even smaller than shown in the table. On the other hand, public-key and ciphertext size might be bigger than the estimate shown in the table if the secret key is generated diﬀerently than the GGH challenges. Table 1. Comparison of the key and ciphertext sizes in the GGH scheme and the modiﬁed scheme. All sizes are in kilobytes (KB). Basis Size Ciphertext dimension GGH New scheme GGH New scheme 200 330 32 2 0.16 250 620 50 3 0.20 300 990 75 4 0.25 350 1630 100 5 0.30 400 2370 140 6 0.35

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

5.3

137

Running Time

The experiments described in the next section have been performed using a highly unoptimized prototype implementation, so we do not have meaningful experimental data on the running time of the new lattice scheme. However a few remarks regarding the running time are due. Encryption time for GGH-like schemes is roughly proportional to the size of the public key. So, if the original GGH cryptosystem was competitive with RSA (see [14]), we should expect the new scheme to outperform RSA in terms of encryption speed because of the reduced key size. Key Generation was one of the major problems in GGH, requiring the application of LLL on a high dimensional matrix with very large entries. Here, key generation essentially consists of a Hermite Normal Form computation, a much simpler task than lattice reduction. Moreover, recent progress on the design of HNF algorithms [23] might lead to eﬃcient key generation procedures. The most critical part of lattice based encryption schemes at this point is probably decryption. In this paper, and in our experiments we have used Babai’s nearest plane algorithm [4], as we believe this is a quite natural choice. Although polynomial time, this algorithm is very slow compared to the linear time encryption procedure, and decrypting lattices in dimension 400 (using the private basis) can take several minutes with a straightforward implementation. In fact, [14] suggested to use the simpler (but less accurate) rounding oﬀ algorithm (also from [4]) instead of nearest plane. It should be noted that the nearest plane algorithm can be made considerably faster if the orthogonalized basis needed by the nearest plane algorithm is precomputed and stored as part of the secret key. Of course, this would increase the size of the secret key, but a relatively poor approximation of the orthogonalized basis should be enough to achieve reasonable correction radius. Decryption methods based on probabilistic rounding procedures as described in [18] are also an interesting alternative to be explored, and much work is still to be done. However, since the decryption procedure is strongly related to the choice of the secret basis, it is probably not worth focusing on the optimization of the decryption algorithm until we get more conﬁdence on what’s a good way to generate the private basis for the lattice. (See Section 6 for further discussion about the choice of the private key.)

6

Discussion and Experiments

We deﬁned a trapdoor function f that is at least as hard to break as the GGH “encryption” scheme. Notice that although the original GGH function was a randomized one, the new function is deterministic. Since any semantically secure encryption scheme must be probabilistic [16], the new function f cannot be a secure encryption scheme in the sense of [16]. It is now clear that also GGH (which is less secure than our new function) cannot be a semantically secure encryption scheme, although it is randomized. The situation is similar to other popular “encryption” functions, like RSA: also RSA is a deterministic function,

138

Daniele Micciancio

and therefore cannot be a semantically secure encryption scheme if directly applied to the message. In fact, encrypting with RSA usually involves padding the message with some random bits, or applying some other randomized procedure. In fact, standard techniques can be used to turn trapdoor functions into semantically secure encryption schemes. In the seminal paper [16] Goldwasser and Micali showed that if h is a hard-core predicate for a trapdoor function f , then E(b, r) = (f (r), h(r)⊕b) is a semantically secure encryption function for one bit messages b ∈ {0, 1}. Hard-core predicates from any one-way (or trapdoor) function can be easily constructed following [37,15], giving a ﬁrst theoretical construction of a semantically secure cryptosystem. The construction is easily generalized to hard-core functions. Namely, if h is a hard-core function for f , then E(m, r) = (f (r), h(r) ⊕ m) is a semantically secure encryption scheme for messages of length equal to the output size of h. Practical instantiations of this scheme can be obtained in the random oracle model [5], simply observing that random oracles are hard-core functions for any one-way function. See [5] also for simple constructions (still in the random oracle model) achieving security against chosen ciphertext attacks [27]. The constructions in [5] have also been recently extended in [26,11,12] to allow for probabilistic trapdoor functions, but these extensions are not required because our trapdoor function is deterministic. A problem that needs further investigation is how to choose the private basis R. In the GGH √cryptosystem R was chosen as the sum of a multiple of the identity matrix nI plus a perturbation matrix Q with small entries qi,j ∈ {−4, . . . , +4}. It is not clear why one should prefer this probability distribution to other distributions, and in fact we think that disclosing the approximate direction of the vectors bi might actually weaken the system. At this point of our research, we believe it is better to leave the set of matrices from which R is chosen as big as possible. A possible way to choose R is2 to choose each entry at random in the interval {−n, . . . , n}. It turns out that random matrices are pretty good on average [8] and running the LLL algorithm [19] on them rapidly yields matrices R with relatively large correction radius ρ = mini ri∗ = O(n). On the other hand, if one applies the LLL basis reduction algorithm to the public basis B = HNF(R), although this time LLL takes a much longer time to terminate, the correction radius obtained is much smaller even in relatively low dimension. In Fig. 4 we show some preliminary experimental results obtained running the LLL algorithm on random matrices, and their Hermite normal forms. We observe that random matrices give a correction radius approximately equal to n/2, while running the LLL algorithm on the Hermite Normal Forms of the same matrices results in a correction radius that approaches zero as the dimension of the lattice grows. These preliminary data clearly show that applying the HNF algorithm reduces the eﬀectiveness of lattice reduction. Still, the plot in Fig. 4 is not clear evidence of the increased security of the scheme for various reasons: ﬁrst of all better result can be achieved using more sophisticated basis reduction algorithms 2

Similar distributions on R were already considered in [14], thought not used in the construction of the challenges [13].

Improving Lattice Based Cryptosystems Using the Hermite Normal Form 120

139

random HNF

100

radius

80

60

40

20

0

0

20

40

60

80

100

120

140

160

180

200

dimension

Fig. 4. Correction radius obtained applying the LLL algorithm to random matrices and their Hermite Normal Forms.

(e.g., [29,30,32]) than LLL. Moreover, the correction radius is only a worst case measure of the quality of a basis. It is still possible that the HNF basis allows to recover from most small errors. To support our claim that the modiﬁed scheme is secure against the strongest lattice attacks we performed the following experiment. We generated a private basis R in dimension 400 × 400 by choosing each entry at random in the interval {−400, . . . , +400}. After running the fast LLL reduction algorithm, the correction radius of the random matrix was ρ = 340. The public basis B = HNF(R) had size 260 KB. Notice that although the size of B is even smaller than the ﬁrst GGH challenge (which was about 330 KB), our theoretical analysis suggests that the new function should still be secure because the underlying lattice has much higher dimension. We then generated random error messages r choosing each entry at random in the interval {−28, . . . , +28} and computed the ciphertexts c = r mod B. The size of c was around 800 B. The error vector had length 320 (i.e. less than the correction radius) and could be correctly recovered from c using R. We then tried to recover r using the public basis B. Following [24], we ﬁrst applied a strong basis reduction algorithm (Block Korkine-Zolotarev reduction [29] with block size 20, as implemented in Victor Shoup’s Number Theory Library [33]) to the public basis B to obtain a reduced

140

Daniele Micciancio

basis G. The computation took over 10 days on a 700 MHz Pentium III workstation. Still the correction radius was only 6.77. Finally, we applied the “embedding technique” (see [24]) to recover r from c and G using the Block KZ reduction algorithm with block size 60 and pruning factor 14 [32]. The clear-text could not be recovered, and even after several days of computation the best lattice vector found by the attack was 500, 000 away from the target, over three orders of magnitude worse than the optimal solution r = 320. Previous cryptanalytic results [24] warn to be cautious about the security of the cryptosystem, and dimension n = 400 should be considered only borderline secure. In fact we suggest the dimension should be at least n ≥ 500, but only after careful cryptanalysis the minimum dimension for which the system is secure in practice can be determined.

7

Other Cryptosystems

In this section we discuss the McEliece and NTRU cryptosystems, and compare them to the general scheme presented in this paper. 7.1

Comparison with the McEliece Cryptosystem

In 1978, McEliece [21] suggested a “cryptosystem” based on the hardness of coding problems that in retrospect is very similar to the GGH cryptosystem. The proposal is to use as a secret key the generating matrix G of a Goppa code, together with a random permutation matrix P and a random invertible matrix S (over GF(2)). The public key is given by the product G = P GS. Then the trapdoor function is deﬁned by f (x, r) = G x + r (all arithmetic performed over GF(2)), where x is a random binary vector, and r is chosen at random among the binary vectors with small Hamming weight. Let c = G x + r be the output of the trapdoor function. Using the secret key, we can ﬁrst compute the permuted target P −1 c = GS + P −1 r. Then we can correct from the small error P −1 r using the decoding algorithm for Goppa codes, retrieving codeword G(Sx). Finally, we can compute x from Sx solving a system of linear equations over GF(2). Notice that this is essentially the same of the GGH cryptosystem with the message m encoded in the coeﬃcients of the lattice vector. A variant of McEliece cryptosystem roughly corresponding to encoding the message in the error vector has also been proposed [25] and the two are known to be equivalent [20]. Interestingly, essentially the same techniques presented in this paper for lattices, can also be used for codes (e.g., they can be applied to [21,25] and many of their variants). Here instead of the Hermite normal form, we use systematic form for the public code G . If [I|H]T is the systematic generating matrix, then the trapdoor function is given by f (x, y) = y − H T x, where x and y have total weight less than the correction radius of the code. However, the advantage of this transformation for codes is not as good as in the lattice case, giving only a constant (typically a factor 2) improvement over the original McEliece scheme.

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

141

A detailed comparison of lattice and coding based cryptosystems is beyond the scope of this paper. However, an apparent advantage of coding based schemes is a potentially smaller public key: since the matrix deﬁning the code has {0, 1} entries, the size of the public key is only O(n2 ), as opposed to O(n2 log n). Of course, this kind of comparisons is not necessarily meaningful if we ﬁrst do not achieve a better understanding of the relation between the hardness of lattice and coding problems. For example, if decoding binary linear codes in dimension n is easier than breaking lattices in the same dimension, then for a fair comparison of the two schemes one should use diﬀerent values of the security parameter. In fact, the original McEliece scheme [21] was already proposing codes with blocklength n = 1024, and recent cryptanalytic work [7] shows that even this large dimension might be insuﬃcient. Interestingly, the nearest codeword problem for binary (or ternary) codes can be eﬃciently reduced to the closest vector problem over the integers: in order to ﬁnd the codeword Cx closest to y, look for a lattice vector in [C|2I] closest to y. This suggests that lattice problems might be harder than coding problems, at least for the binary case. For larger alphabets, the relation between codes and lattices is less clear. However, if large alphabets are used, then the public key size for code based cryptosystems would increase. For example, if Reed-Solomon codes were used, then the alphabet size would be n, giving keys of total size O(n2 log n), matching the asymptotic key size of lattice based cryptosystems. (Here Reed-Solomon codes are just an hypothetical example, as these codes are known not to be secure [34].) We hope that our work will stimulate further investigations on the relation between lattice and coding problems. 7.2

The NTRU Cryptosystem

NTRU is a cryptosystem based on polynomial ring arithmetic proposed by Hoﬀstein, Pipher and Silverman in [17]. The system works essentially as follows. Let n, p, q be system parameters where n is a security parameter (say n = 200), p is a small prime (say, p = 3) and q is a relatively large prime (typically q = Ω(n)). The secret key is a pair of degree n − 1 polynomials a(X), b(X) ∈ Z[X] with small coeﬃcients, such that a(X) is invertible modulo (X n − 1, pq). The public key is given by c(X) = p · g(X)/f (X) mod (X n − 1, q). The encryption function takes as input two polynomials m(X), r(X) ∈ Z[X]/(X N − 1) with small coeﬃcients (the ﬁrst interpreted as a message, and the second as a randomizer), and outputs c(X) · r(X) + m(X) mod (X n − 1, q). (For the decription procedure, as well as a more detailed description of the system, see the original article [17].) As for the GGH and the McEliece cryptosystem, NTRU does not provide semantic security, so it is better described as a deterministic trapdoor function, instead of a full ﬂedged probabilistic cryptosystem. Interestingly, this function can be formulated in terms of lattices as follows. Consider the lattice generated by the 2n × 2n matrix c·I C 0 I

142

Daniele Micciancio

where C is the n × n matrix whose rows are given by all ncyclic permutations of the coeﬃcients [c0 , c1 , . . . , cn−1 ] of polynomial c(X) = i=0 ci X i , i.e., C i,j = c(j−i mod n) . Notice that this public basis is in Hermite normal form. Moreover, it is easy to see that the output c(X)r(X) + m(X) of the trapdoor function is exactly the result of reducing vector [mn−1 , . . . , m0 , −rn−1 , . . . , −r0 ]T modulo the public lattice basis. So, when viewed as a lattice based trapdoor function, NTRU has the same high level structure of the functions described in this paper: the public key is an HNF lattice basis, and the function is computed reducing small “error” vector modulo the public basis. What sets NTRU apart from all other lattice based functions is the use of a class of lattices with special structure: convolutional modular lattices. While the security oﬀered by this class of lattices is still largely to be investigated, the performance advantage is clear: as the HNF basis can be represented by only n (log n)-bit numbers, the public key is much smaller than those obtained using general lattices which require (n2 log n) bits.

8

Conclusion

We presented a new trapdoor function based on the hardness of lattice problems. The trapdoor function can be transformed into a full ﬂedged encryption algorithm using standard techniques [16,5]. The new function can be formally proved to be at least as secure as any other function from a general scheme to design lattice based trapdoor functions that includes the GGH trapdoor function [14] and the tensor based trapdoor function [10] as special cases. Moreover, the new function substantially improves previous proposals from the eﬃciency point of view: for the same level of security the new function reduces both the time and space requirements by a factor O(n). The improved eﬃciency allows to use bigger values of the security parameter while maintaining the scheme reasonably practical. One last advantage of the new scheme is simplicity. While previous schemes computed the public key and function values using a substantial amount of randomness, in the new function these operations are substituted by simple deterministic procedures. This is important both from the theoretical and practical point of view, because it makes the algorithms easier to implement and also easier to analyze. At this point the main question about lattice based cryptography is how to choose the private key, i.e., ﬁnding families of easily decodable lattices for which decoding becomes infeasible when the lattice is presented in Hermite normal form. We believe that in order to be really competitive with RSA, key sizes even smaller than those achieved in this paper would be desirable. However, the public key size cannot be further reduced unless one considers classes of lattices with special structure. (A simple counting argument shows that the number of lattices in a certain dimension is exponential in the bit-size representation of their Hermite normal forms, so the HNF representation is essentially optimal if one considers arbitrary lattices.) The search for easily decodable lattices for which decoding is hard when the lattice is presented in Hermite normal form becomes particularly interesting if one could ﬁnd special classes of hard lattices that have

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

143

small HNF representation. We observed that one such family of lattices is given by the NTRU trapdoor function. Again, the main question is security. Are the convolutional modular lattices used by NTRU really hard to decode? We hope that our work will stimulate further research on the computational complexity of decoding this and other classes of lattices. Acknowledgements The author wishes to thank Shai Halevi, Shaﬁ Goldwasser and Salil Vadhan for many stimulating conversations on lattice based cryptography. Thanks also to the anonymous referees for their useful comments.

References 1. M. Ajtai. Generating hard instances of lattice problems (extended abstract). In Proceedings of the Twenty-Eighth Annual ACM Symposium on the Theory of Computing, pages 99–108, Philadelphia, Pennsylvania, 22–24 May 1996. 2. M. Ajtai and C. Dwork. A public-key cryptosystem with worst-case/average-case equivalence. In Proceedings of the Twenty-Ninth Annual ACM Symposium on Theory of Computing, pages 284–293, El Paso, Texas, 4–6 May 1997. 3. S. Arora, L. Babai, J. Stern, and E.Z. Sweedyk. The hardness of approximate optima in lattices, codes, and systems of linear equations. J. Comput. Syst. Sci., 54(2):317–331, Apr. 1997. Preliminary version in FOCS’93. 4. L. Babai. On Lovasz’ lattice reduction and the nearest lattice point problem. Combinatorica, 6(1):1–13, 1986. 5. M. Bellare and P. Rogaway. Random oracles are practical: A paradigm for designing eﬃcient protocols. In Proceedings of the first ACM Conference on Computer and Communications Security. ACM, Nov. 1993. 6. J.-Y. Cai and T.W. Cusick. A lattice-based public-key cryptosystem. Information and Computation, 151(1–2):17–31, May–June 1999. 7. A. Canteaut and N. Sendrier. Cryptanalysis of the original McEliece cryptosystem. In K. Ohta and D. Pei, editors, Advances in Cryptology — Proceedings of Asiacrypt’98, volume 1514 of Lecture Notes in Computer Science, pages 187–199, Beijing, China, 1998. 8. H. Daude and B. Vall´ee. An upper bound on the average number of iterations of the LLL algorithm. Theoretical Computer Science, 123(1):95–115, Jan. 1994. 9. I. Dinur, G. Kindler, and S. Safra. Approximating CVP to within almostpolynomial factors is NP-hard. In 39th Annual Symposium on Foundations of Computer Science, Palo Alto, California, 7–10 Nov. 1998. IEEE. 10. R. Fischlin and J.-P. Seifert. Tensor-based trapdoors for CVP and their application to public key cryptography. In 7th IMA International Conference ”Cryptography and Coding”, volume 1746 of Lecture Notes in Computer Science, pages 244–257. Springer-Verlag, 1999. 11. E. Fujisaki and T. Okamoto. Secure integration of asymmetric and symmetric encryption schemes. In M. Wiener, editor, Advances in Cryptology—CRYPTO’99, volume 1666 of Lecture Notes in Computer Science, pages 537–554, University of California, Santa Barbara, Aug. 1999. IACR, Springer-Verlag.

144

Daniele Micciancio

12. E. Fujisaki and T. Okamoto. How to enhance the security of public-key encryption at minimum cost. IEICE Transaction of Fundamentals of electronic Communications and Computer Science, E38-A(1):24–32, Jan. 2000. 13. O. Goldreich, S. Goldwasser, and S. Halevi. The GGH cryptosystem, challenge page. http://theory.lcs.mit.edu/~cis/lattice/challenge.html. 14. O. Goldreich, S. Goldwasser, and S. Halevi. Public-key cryptosystems from lattice reduction problems. In B. S. Kaliski Jr., editor, Advances in Cryptology— CRYPTO’97, volume 1294 of Lecture Notes in Computer Science, pages 112–131. Springer-Verlag, 17–21 Aug. 1997. 15. O. Goldreich and L. Levin. A hard predicate for all one-way functions. In Proceedings of the 21st Annual Symposium on Theory of Computing (STOC). ACM, 1989. 16. S. Goldwasser and S. Micali. Probabilistic encryption. Journal of Computer and System Sience, 28(2):270–299, 1984. Preliminary version in STOC’82. 17. J. Hoﬀstein, J. Pipher, and J.H. Silverman. NTRU: A ring based public key cryptosystem. In J. Buhler, editor, Algorithmic Number Theory (ANTS III), volume 1423 of Lecture Notes in Computer Science, pages 267–288, Portland, OR, 1998. Springer. 18. P. Klein. Finding the closest lattice vector when it’s unusually close. In Proceedings of the 11th Symposium on Discrete Algorithms, San Francisco, California, Jan. 2000. SIAM. 19. A.K. Lenstra, H.W. Lenstra, Jr., and L. Lov´ asz. Factoring polynomials with rational coeﬃcients. Mathematische Annalen, 261:513–534, 1982. 20. Y.X. Li, R.H. Deng, and X.M. Wang. On the equivalence of McEliece’s and Niederreiter’s public-key cryptosystems. IEEE Transactions on Information Theory, 40(1):271–273, Jan. 1994. 21. R.J. McEliece. A public-key cryptosystem based on algebraic coding theory. DSN Progress Report 42-44, Jet Propulsion Laboratory, Pasadena, 1978. 22. D. Micciancio. The hardness of the closest vector problem with preprocessing. IEEE Transactions on Information Theory, 2001. To Appear. 23. D. Micciancio and B. Warinschi. A linear space algorithm for computing the Hermite Normal Form. In B. Mourrain, editor, International Symposium on Symbolic and Algebraic Computation. ACM 2001. To Appear. 24. P. Nguyen. Cryptanalysis of the Goldreich-Goldwasser-Halevi cryptosystem from Crypto’97. In M. Wiener, editor, Advances in Cryptology—CRYPTO’99, volume 1666 of Lecture Notes in Computer Science. Springer-Verlag, Aug. 1999. 25. H. Niederreiter. Knapsack-type cryptosystems and algebraic coding theory. Problems of Control and Information Theory, 15(2):159–166, 1986. 26. T. Okamoto and D. Pointcheval. React: Rapid enhanced-security asymmetric cryptosystem transform. In D. Naccache, editor, Proceedings of the Cryptographers’ Track of the RSA Conference ’2001 (RSA 2001), Lecture Notes in Computer Science, San Francisco, California, USA, 8–12Apr. 2001. Springer-Verlag. 27. C. Rackoﬀ and D. R. Simon. Non-interactive zero-knowledge proof of knowledge and chosen ciphertext attack. In J. Feigenbaum, editor, Advances in Cryptology: Proceedings of Crypto’91, volume 576 of Lecture Notes in Computer Science, University of California, Santa Barbara, Aug. 1991. IACR, Springer-Verlag. 28. R. L. Rivest, A. Shamir, and L. Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21:120–126, 1978. 29. C.-P. Schnorr. A hierarchy of polynomial time lattice basis reduction algorithms. Theoretical Computer Science, 53(2–3):201–224, 1987.

Improving Lattice Based Cryptosystems Using the Hermite Normal Form

145

30. C.-P. Schnorr and M. Euchner. Lattice basis reduction: Improved practical algorithms and solving subset sum problems. In L. Budach, editor, Proceedings of Fundamentals of Computation Theory, volume 529 of LNCS, pages 68–85. SpringerVerlag, 1991. 31. C.-P. Schnorr, M. Fischlin, H. Koy, and A. May. Lattice attacks on GGH cryptosystem. Rump session of Crypto’97, 1997. 32. C.-P. Schnorr and H. H. H¨ orner. Attacking the Chor–Rivest cryptosystem by improved lattice reduction. In L. C. Guillou and J.-J. Quisquater, editors, Advances in Cryptology—EUROCRYPT’95, volume 921 of Lecture Notes in Computer Science, pages 1–12. Springer-Verlag, 21–25 May 1995. 33. V. Shoup. NTL: A library for doing number theory. Available on-line at URL http://www.shoup.net/ntl/index.html. 34. V. Sidelnikov and S. Shestakov. On cryptosystems based on generalized ReedSolomon codes. Diskretnaya Math, 4(3):57–63, 1992. In Russian. 35. N. J. A. Sloane. Encryption by random rotations. In Workshop on Cryptography Burg Feuerstein 1982, volume 149 of Lecture Notes in Computer Science, pages 71–129, 1983. 36. P. van Emde Boas. Another NP-complete problem and the complexity of computing short vectors in a lattice. Technical Report 81-04, Mathematische Instituut, Universiry of Amsterdam, 1981. Available on-line at URL http://turing.wins.uva.nl/~peter/. 37. A. Yao. Theory and applications of trapdoor functions. In Proceedings of the 23rd IEEE Symposium on Foundations of Computer Science (FOCS), pages 80– 91, Chicago, IL, 1982. IEEE.

The Two Faces of Lattices in Cryptology Phong Q. Nguyen and Jacques Stern ´ Ecole Normale Sup´erieure, D´epartement d’Informatique 45 rue d’Ulm, 75005 Paris, France [email protected] http://www.di.ens.fr/~pnguyen/ [email protected] http://www.di.ens.fr/~stern/

Abstract. Lattices are regular arrangements of points in n-dimensional space, whose study appeared in the 19th century in both number theory and crystallography. Since the appearance of the celebrated LenstraLenstra-Lov´ asz lattice basis reduction algorithm twenty years ago, lattices have had surprising applications in cryptology. Until recently, the applications of lattices to cryptology were only negative, as lattices were used to break various cryptographic schemes. Paradoxically, several positive cryptographic applications of lattices have emerged in the past ﬁve years: there now exist public-key cryptosystems based on the hardness of lattice problems, and lattices play a crucial rˆ ole in a few security proofs. We survey the main examples of the two faces of lattices in cryptology.

1

Introduction

Lattices are discrete subgroups of Rn . A lattice has inﬁnitely many Z-bases, but some are more useful than others. The goal of lattice reduction is to ﬁnd interesting lattice bases, such as bases consisting of reasonably short and almost orthogonal vectors. From the mathematical point of view, the history of lattice reduction goes back to the reduction theory of quadratic forms developed by Lagrange [86], Gauss [55], Hermite [68], Korkine and Zolotarev [82,83], among others, and to Minkowski’s geometry of numbers [103]. With the advent of algorithmic number theory, the subject had a revival in 1981 with Lenstra’s celebrated work on integer programming (see [89,90]), which was, among others, based on a novel lattice reduction technique (which can be found in the preliminary version [89] of [90]). Lenstra’s reduction technique was only polynomial-time for ﬁxed dimension, which was however enough in [89]. That inspired Lov´ asz to develop a polynomial-time variant of the algorithm, which computes a so-called reduced basis of a lattice. The algorithm reached a ﬁnal form in the seminal paper [88] where Lenstra, Lenstra and Lov´asz applied it to factor rational polynomials in polynomial time (back then, a famous problem), from which the name LLL comes. Further reﬁnements of the LLL algorithm were later proposed, notably by Schnorr [121,122]. Those algorithms have proved invaluable in many areas of mathematics and computer science (see [91,78,132,64,36,84]). In particular, their relevance to cryptology was immediately understood, and they were used to break schemes based J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 146–180, 2001. c Springer-Verlag Berlin Heidelberg 2001

The Two Faces of Lattices in Cryptology

147

on the knapsack problem (see [119,29]), which were early alternatives to the RSA cryptosystem [120]. The success of reduction algorithms at breaking various cryptographic schemes over the past twenty years (see [75]) have arguably established lattice reduction techniques as the most popular tool in public-key cryptanalysis. As a matter of fact, applications of lattices to cryptology have been mainly negative. Interestingly, it was noticed in many cryptanalytic experiments that LLL, as well as other lattice reduction algorithms, behave much more nicely than what was expected from the worst-case proved bounds. This led to a common belief among cryptographers, that lattice reduction is an easy problem, at least in practice. That belief has recently been challenged by some exciting progress on the complexity of lattice problems, which originated in large part in two seminal papers written by Ajtai in 1996 and in 1997 respectively. Prior to 1996, little was known on the complexity of lattice problems. In his 1996 paper [3], Ajtai discovered a fascinating connection between the worst-case complexity and the average-case complexity of some well-known lattice problems. Such a connection is not known to hold for any other problem in NP believed to be outside P. In his 1997 paper [4], building on previous work by Adleman [2], Ajtai further proved the NP-hardness (under randomized reductions) of the most famous lattice problem, the shortest vector problem (SVP). The NP-hardness of SVP has been a long standing open problem. Ajtai’s breakthroughs initiated a series of new results on the complexity of lattice problems, which are nicely surveyed by Cai [30,31]. Those complexity results opened the door to positive applications in cryptology. Indeed, several cryptographic schemes based on the hardness of lattice problems were proposed shortly after Ajtai’s discoveries (see [5,61,69,32,99,50]). Some have been broken, while others seem to resist state-of-the-art attacks, for now. Those schemes attracted interest for at least two reasons: on the one hand, there are very few public-key cryptosystems based on problems diﬀerent from integer factorization or the discrete logarithm problem, and on the other hand, some of those schemes oﬀered encryption/decryption rates asymptotically higher than classical schemes. Besides, one of those schemes, by Ajtai and Dwork [5], enjoyed a surprising security proof based on worst-case (instead of average-case) hardness assumptions. Independently of those developments, there has been renewed cryptographic interest in lattice reduction, following a beautiful work by Coppersmith [38] in 1996. Coppersmith showed, by means of lattice reduction, how to solve rigorously certain problems, apparently non-linear, related to the question of ﬁnding small roots of low-degree polynomial equations. In particular, this has led to surprising attacks on the RSA [120] cryptosystem in special settings such as low public or private exponent, but curiously, also to new security proofs [128,18]. Coppersmith’s results diﬀer from “traditional” applications of lattice reduction in cryptanalysis, where the underlying problem is already linear, and the attack often heuristic by requiring (at least) that current lattice reduction algorithms behave ideally, as opposed to what is theoretically guaranteed. The use of lattice reduction techniques to solve polynomial equations goes back to the eighties [66,133]. The ﬁrst result of that kind, the broadcast attack on low-exponent

148

Phong Q. Nguyen and Jacques Stern

RSA due to H˚ astad [66], can be viewed as a weaker version of Coppersmith’s theorem on univariate modular polynomial equations. A shorter version of this survey previously appeared in [118]. The rest of the paper is organized as follows. In Section 2, we give basic deﬁnitions and results on lattices and their algorithmic problems. In Section 3, we survey an old application of lattice reduction in cryptology: ﬁnding small solutions of multivariate linear equations, which includes the well-known subset sum or knapsack problem as a special case. In Section 4, we review a related problem: the hidden number problem. In Section 5, we discuss lattice-based cryptography, somehow a revival for knapsack-based cryptography. In Section 6, we discuss developments on the problem of ﬁnding small roots of polynomial equations, inspired by Coppersmith’s discoveries in 1996. In Section 7, we survey the surprising links between lattice reduction, the RSA cryptosystem, and integer factorization.

2 2.1

Lattice Problems Deﬁnitions

Recall that a lattice is a discrete (additive) subgroup of Rn . In particular, any subgroup of Zn is a lattice, and such lattices are called integer lattices. An equivalent deﬁnition is that a lattice consists of all integral linear combinations of a set of linearly independent vectors, that is, d L= ni bi | ni ∈ Z , i=1

where the bi ’s are linearly independent over R. Such a set of vectors bi ’s is called a lattice basis. All the bases have the same number dim(L) of elements, called the dimension (or rank) of the lattice since it matches the dimension of the vector subspace span(L) spanned by L. There are inﬁnitely many lattice bases when dim(L) ≥ 2. Any two bases are related to each other by some unimodular matrix (integral matrix of determinant ±1), and therefore all the bases share the same Gramian determinant det1≤i,j≤d bi , bj . The volume vol(L) (or determinant) of the lattice is by deﬁnition the square root of that Gramian determinant, thus corresponding to the d-dimensional volume of the parallelepiped spanned by the bi ’s. In the important case of full-dimensional lattices where dim(L) = n, the volume is equal to the absolute value of the determinant of any lattice basis (hence the name determinant). If the lattice is further an integer lattice, then the volume is also equal to the index [Zn : L] of L in Zn . Since a lattice is discrete, it has a shortest non-zero vector: the Euclidean norm of such a vector is called the lattice ﬁrst minimum, denoted by λ1 (L) or L. Of course, one can use other norms as well: we will use L∞ to denote the ﬁrst minimum for the inﬁnity norm. More generally, for all 1 ≤ i ≤ dim(L), Minkowski’s i-th minimum λi (L) is deﬁned as the minimum of max1≤j≤i vj over all i linearly independent lattice vectors v1 , . . . , vi ∈ L. There always exist linearly independent lattice vectors v1 , . . . , vd reaching the minima, that is

The Two Faces of Lattices in Cryptology

149

vi = λi (L). However, surprisingly, as soon as dim(L) ≥ 4, such vectors do not necessarily form a lattice basis, and when dim(L) ≥ 5, there may not even exist a lattice basis reaching the minima. This is one of the reasons why there exist several notions of basis reduction in high dimension, without any “optimal” one. It will be convenient to deﬁne the lattice gap as the ratio λ2 (L)/λ1 (L) between the ﬁrst two minima. Minkowski’s Convex Body Theorem guarantees the existence of short vectors in lattices: a careful application shows that any d-dimensional lattice L vol(L)1/d , which is obviously the best possible bound. It folsatisﬁes L∞ ≤ √ lows that L ≤ dvol(L)1/d , which is not optimal, but shows that the value λ1 (L)/vol(L)1/d is bounded when L runs over all d-dimensional lattices. The supremum of λ1 (L)2 /vol(L)2/d is denoted by γd , and called Hermite’s constant1 of dimension d, because Hermite was the ﬁrst to establish its existence in the language of quadratic forms. The exact value of Hermite’s constant is only known for d ≤ 8. The best asymptotic bounds known for Hermite’s constant are the following ones (see [102, Chapter II] for the lower bound, and [37, Chapter 9] for the upper bound): log(πd) d 1.744d + + o(1) ≤ γd ≤ (1 + o(1)). 2πe 2πe 2πe Minkowski proved more generally: Theorem 1 (Minkowski). For all d-dimensional lattices L and all r ≤ d: r i=1

λi (L) ≤

r γd vol(L)r/d .

A general principle, dating back to Gauss, estimates the number of lattice points (in a full-rank lattice) in nice sets of Rn by the volume of the set divided by the volume of the lattice, with a small error term. This approach can be proved to be rigorous in certain settings, such as when the lattice dimension is ﬁxed and the set is the ball centered at the origin with radius growing to inﬁnity. Thus, one often heuristically approximates the successive minima of a d-dimensional

d vol(L)1/d . This is of course only an intuitive estimate, which lattice L by 2πe may be far away from the truth. For any lattice L of Rn , one deﬁnes the dual lattice (also called polar lattice) of L as: L∗ = {x ∈ span(L) : ∀y ∈ L, x, y ∈ Z}.

If (b1 , . . . , bd ) is a basis of L, then the dual family (b∗1 , . . . , b∗d ) is a basis of L∗ (the dual family is the unique linearly independent family of span(L) such that b∗i , bj is equal to 1 if i = j, and to 0 otherwise). Thus, (L∗ )∗ = L and vol(L)vol(L∗ ) = 1. The so-called transference theorems relate the successive 1

For historical reasons, Hermite’s constant refers to max λ1 (L)2 /vol(L)2/d and not to max λ1 (L)/vol(L)1/d .

150

Phong Q. Nguyen and Jacques Stern

minima of a lattice and its dual lattice. The ﬁrst transference theorem follows from the deﬁnition of Hermite’s constant: λ1 (L)λ1 (L∗ ) ≤ γd . A more diﬃcult transference theorem (see [9]) ensures that for all 1 ≤ r ≤ d: λr (L)λd−r+1 (L∗ ) ≤ d. Both these transference bounds are optimal up to a constant. More information on lattice theory can be found in numerous textbooks, such as [65,131,92]. 2.2

Algorithmic Problems

In the rest of this section, we assume implicitly that lattices are rational lattices (lattices in Qn ), and d will denote the lattice dimension. The most famous lattice problem is the shortest vector problem (SVP): given a basis of a lattice L, ﬁnd u ∈ L such that u = L (recall that L = λ1 (L)). SVP∞ will denote the analogue for the inﬁnity norm. One deﬁnes approximate short vector problems by asking a non-zero u ∈ L with norm bounded by some approximation factor: u ≤ f (d)L. The closest vector problem (CVP), also called the nearest lattice point problem, is a non-homogeneous version of the shortest vector problem: given a basis of a lattice L and a vector v ∈ Rn (it does not matter whether v ∈ span(L)), ﬁnd a lattice vector minimizing the distance to v. Again, one deﬁnes approximate closest vector problems by asking u ∈ L such that for all w ∈ L, u − v ≤ f (d)w − v. Another problem is the smallest basis problem (SBP), which has many variants depending on the exact meaning of “smallest”. The variant currently in vogue (see [3,14]) is the following: ﬁnd a lattice basis minimizing the maximum of the lengths of its elements. A more geometric variant asks instead to minimize the product of the lengths (see [64]), since the product is always larger than the lattice volume, with equality if and only if the basis is orthogonal. 2.3

Complexity Results

We refer to Cai [30,31] for an up-to-date survey of complexity results. Ajtai [4] recently proved that SVP is NP-hard under randomized reductions. Micciancio [98,97] simpliﬁed and √improved the result by showing that approximating SVP to within a factor < 2 is also NP-hard under randomized reductions. The NP-hardness of SVP under deterministic (Karp) reductions remains an open problem. CVP seems to be a more diﬃcult problem. Goldreich et al. [62] recently noticed that CVP cannot be easier than SVP: given an oracle that approximates CVP to within a factor f (d), one can approximate SVP in polynomial time to within the same factor f (d). Reciprocally, Kannan proved in [78, Section 7] that any algorithm approximating SVP to within a non-decreasing function f (d) can

The Two Faces of Lattices in Cryptology

151

be used to approximate CVP to within d3/2 f (d)2 . CVP was shown to be NPhard as early as in 1981 [49] (for a much simpler “one-line” proof using the knapsack problem, see [100]). Approximating CVP to within a quasi-polynomial 1−ε factor 2log d is NP-hard [7,45]. However, NP-hardness results for SVP and CVP have limits. Goldreich and Goldwasser [58] showed that approximating SVP or CVP to within d/ log d is not NP-hard, unless the polynomial-time hierarchy collapses. Interestingly, SVP and CVP problems seem to be more diﬃcult with the inﬁnity norm. It was shown that SVP∞ and CVP∞ are NP-hard in 1981 [49]. In fact, approximating SVP∞ /CVP∞ to within an almost-polynomial factor d1/ log log d is NP-hard [44]. On the other hand, Goldreich and Goldwasser [58] showed that approximating SVP∞ /CVP∞ to within d/ log d is not NP-hard, unless the polynomial-time hierarchy collapses. We will not discuss Ajtai’s worst-case/average-case equivalence [3,33], which refers to special versions of SVP and SBP (see [30,31,14]) such as SVP when the lattice gap λ2 /λ1 is at least polynomial in the dimension. 2.4

Algorithmic Results

The main algorithmic results are surveyed in [91,78,132,64,36,84,30,109]. No polynomial-time algorithm is known for approximating either SVP, CVP or SBP to within a polynomial factor in the dimension d. In fact, the existence of such algorithms is an important open problem. The best polynomial-time algorithms achieve only slightly subexponential factors, and are based on the LLL algorithm [88], which can approximate SVP and SBP. However, it should be emphasized that these algorithms typically perform much better than is theoretically guaranteed, on instances of practical interest. Given as input any basis of a lattice L, LLL provably outputs in polynomial time a basis (b1 , . . . , bd ) satisfying: b1 ≤ 2(d−1)/4 vol(L)1/d , bi ≤ 2(d−1)/2 λi (L) and

d

d

bi ≤ 2(2)/2 vol(L).

i=1

Thus, LLL can approximate SVP to within 2(d−1)/2 . Schnorr2 [121] improved 2 the bound to 2O(d(log log d) / log d) , and Ajtai et al. [6] recently further improved it to 2O(d log log d/ log d) in randomized polynomial time thanks to a new randomized algorithm to ﬁnd the shortest vector. In fact, Schnorr deﬁned an LLL-based family of algorithms [121] (named BKZ for blockwise Korkine-Zolotarev) whose performances depend on a parameter called the blocksize. These algorithms use some kind of exhaustive search super-exponential in the blocksize. So far, the best reduction algorithms in practice are variants [124,125] of those BKZ-algorithms, 2

Schnorr’s result is usually cited in the literature as an approximation algorithm to within (1+ε)n for any constant ε > 0. However, Goldreich and H˚ astad noticed about two years ago that one can choose some ε = o(1) and still have polynomial running time, for instance using the blocksize k = log d/ log log d in [121].

152

Phong Q. Nguyen and Jacques Stern

which apply a heuristic to reduce exhaustive search. But little is known on the average-case (and even worst-case) complexity of reduction algorithms. Babai’s nearest plane algorithm [8] uses LLL to approximate CVP to within 2d/2 , in polynomial time (see also [80]). Using Schnorr’s algorithm [121], this 2 can be improved to 2O(d(log log d) / log d) in polynomial time, and even further to 2O(d log log d/ log d) in randomized polynomial time using [6], due to Kannan’s link between CVP and SVP (see previous section). In practice however, the best strategy seems to be the embedding method (see [61,108]), which uses the previous algorithms for SVP and a simple heuristic reduction from CVP to SVP. Namely, given a lattice basis (b1 , . . . , bd ) and a vector v ∈ Rn , the embedding method builds the (d+1)-dimensional lattice (in Rn+1 ) spanned by the row vectors (bi , 0) and (v, 1). Depending on the lattice, one should choose a coeﬃcient diﬀerent than 1 in (v, 1). It is hoped that a shortest vector of that lattice is of the form (v − u, 1) where u is a closest vector (in the original lattice) to v, whenever the distance to the lattice is smaller than the lattice ﬁrst minimum. This heuristic may fail (see for instance [97] for some simple counterexamples), but it can also sometimes be proved, notably in the case of lattices arising from low-density knapsacks. For exact SVP, the best algorithm known (in theory) is the recent randomized 2O(d) -time algorithm by Ajtai et al. [6], which improved Kannan’s super-exponential algorithm [77,79] (see also [67]). For exact CVP, the best algorithm remains Kannan’s super-exponential algorithm [77,79], with running time 2O(d log d) (see also [67] for an improved constant).

3

Finding Small Roots of Multivariate Linear Equations

One of the early and most natural applications of lattice reduction in cryptology was to ﬁnd small roots of multivariate linear equations, where the equations are either integer equations or modular equations. 3.1

Knapsacks

Cryptology and lattices share a long history with the knapsack (also called subset sum) problem, a well-known NP-hard problem considered by Karp, and a particular case of multivariate linear n equation: given a set {a1 , a2 , . . . , an } of positive integers and a sum s = i=1 xi ai , where xi ∈ {0, 1}, recover the xi ’s. In 1978, Merkle and Hellman [96] invented one of the ﬁrst public-key cryptosystems, by converting some easy knapsacks into what they believed were hard knapsacks. It was basically the unique alternative to RSA until 1982, when Shamir [126] proposed a (heuristic) attack against the simplest version of the Merkle-Hellman scheme. Shamir used Lenstra’s integer programming algorithm [89,90] but, the same year, Adleman [1] showed how to use LLL instead, making experiments much easier. Brickell [27,28] later extended the attacks to the more general “iterated” Merkle-Hellman scheme, and showed that MerkleHellman was insecure for all realistic parameters. The cryptanalysis of MerkleHellman schemes was the ﬁrst application of lattice reduction in cryptology.

The Two Faces of Lattices in Cryptology

153

Despite the failure of Merkle-Hellman cryptosystems, researchers continued to search for knapsack cryptosystems because such systems are very easy to implement and can attain very high encryption/decryption rates. But basically, all knapsack cryptosystems have been broken (for a survey, see [119]), either by speciﬁc (often lattice-based) attacks or by the low-density attacks. The last signiﬁcant candidate to survive was the Chor-Rivest cryptosystem [35], broken by Vaudenay [135] in 1997 with algebraic (not lattice) methods.

3.2

Low-Density Attacks on Knapsacks

We only describe the basic link between lattices and knapsacks. Note that Ajtai’s original proof [4] for the NP-hardness (under randomized reductions) of SVP used a connection between the subset sum problem and SVP. Solving the knapsack problem amounts to ﬁnd a 0, 1-solution of an inhomogeneous linear equation, which can be viewed as a closest vector problem in a natural way, by considering the corresponding homogeneous linear equation, together n with an arbitrary solution of the inhomogeneous equation. Indeed, let s = i=1 xi ai be a knapsack instance. n One can compute in polynomial time integers y1 , . . . , yn such that s = i=1 yi ai , using for instance an extended gcd algorithm. Then the vector (y1 − x1 , . . . , yn − xn ) belongs to the (n − 1)dimensional lattice L formed by all the solutions of the homogeneous equation, that is the vectors (z1 , . . . , zn ) ∈ Zn such that: z1 a1 + · · · + zn an = 0. And this lattice vector is fairly close to the vector (y1 , . . . , yn ), since the distance is roughly n/2. But because xi ∈ {0, 1}, the lattice vector is even closer to the vector y = (y1 − 1/2, . . . , yn − 1/2) for which the distance is exactly n/4. In fact, it is easy to see that x = (y1 − x1 , . . . , yn − xn ) is a closest vectorto y in the lattice L, and that any lattice vector whose distance to y is exactly n/4 is necessarily of the form (y1 −x1 , . . . , yn −xn ) where s = ni=1 xi ai and xi ∈ {0, 1}. This gives a deterministic polynomial-time reduction from the knapsack problem to CVP (this reduction appeared in [100] with a slightly diﬀerent lattice). One can derive from this reduction a provable method to solve the knapsack problem in polynomial time with high probability when the knapsack density deﬁned as d = n/ max1≤i≤n log2 ai is low (see [85,51,54]). Indeed, if x − y = n/4 is strictly less than 2−(n−1)/2−1 L, then by applying Babai’s nearest plane CVP approximation algorithm to L and y, one obtains z ∈ L such that z − y < 2n/2 x − y < L/2, and thus z − x < L where z − x ∈ L, which implies that z = x, disclosing the xi ’s. It remains to estimate the ﬁrst minimum L. With high probability, the ai ’s are coprime, and then:

vol(L) =

n i=1

1/2 a2i

√ ≈ 2n/d n.

154

Phong Q. Nguyen and Jacques Stern

n Thus, one expects L ≈ 21/d 2πe . It follows that the method should work whenever

n n < 2−(n−1)/2−1 21/d , 4 2πe that is, roughly d ≤ 2/n. This volume argument can be made rigorous because the probability that a ﬁxed non-zero vector belongs to L is less than 1/A when the ai ’s are chosen uniformly at random from [0, A]. One deduces that most knapsacks of density roughly less than 2/n are solvable in polynomial time (see [85,51,54]). One does not know how to provably solve the knapsack problem in polynomial time when the density lies between 2/n and 1, which is typically the case for cryptographic knapsacks (where the density should be less than 1, otherwise heuristically, there would be several solutions, causing decryption troubles). However, one can hope that the embedding method that heuristically reduces CVP to SVP works, as while as the distance to the lattice (which is n/4) is smaller than the ﬁrst minimum L. By the previous reasoning, this should happen when

n n ≤ 21/d , 4 2πe that is, d≤

1 ≈ 0.955 . . . log2 πe/2

This heuristic bound turns out to be not too far away from the truth. Indeed, one can show that the target vector (x1 − 1/2, . . . , xn − 1/2, 1) is with high probability (over the choice of the ai ’s) the shortest vector in the embedding lattice, when the density d ≤ 0.9408 . . . (see [41] who used a slightly diﬀerent lattice, but the proof carries through). This is done by enumerating all possible short vectors, and using bounds on the number of integral points in high-dimensional spheres [93]. The result improved the earlier bound of 0.6463 . . . from Lagarias and Odlyzko [85], which was essentially obtained by approximating the vector (y1 , . . . , yn ) in the lattice L, instead of (y1 − 1/2, . . . , yn − 1/2). This rigorous bound of 0.6463 . . . matches the heuristic bound obtained by a volume argument on the corresponding embedding lattice:

n n 1/d ≤2 . 2 2πe To summarize, the subset sum problem can always be eﬃciently reduced to CVP, and this reduction leads to an eﬃcient probabilistic reduction to SVP in low density, and to a polynomial-time solution in extremely low density. In the light of recent results on the complexity of SVP, those reductions from knapsack to SVP may seem useless. Indeed, the NP-hardness of SVP under randomized reductions suggests that there is no polynomial-time algorithm that solves SVP. However, it turns out that in practice, one can hope that standard lattice reduction algorithms behave like SVP-oracles, up to reasonably high dimensions.

The Two Faces of Lattices in Cryptology

155

Experiments carried out in [85,124,125] show the eﬀectiveness of such an approach for solving low-density subset sums, up to n about the range of 100–200. It does not prove nor disprove that one can solve, in theory or in practice, lowdensity knapsacks with n over several hundreds. But it was suﬃcient to show that knapsack cryptography was impractical: indeed, the keysize of knapsack schemes grows in general at least quadratically with n, so that high values of n (as required by lattice attacks) are not practical. Thus, lattice methods to solve the subset sum problem are mainly heuristic. And lattice attacks against knapsack cryptosystems are somehow even more heuristic, because the reductions from knapsack to SVP assume a uniform distribution of the weights ai ’s, which is in general not necessarily satisﬁed by knapsacks arising from cryptosystems. 3.3

The Orthogonal Lattice

Recently, Nguyen and Stern proposed in [113] a natural generalization of the lattices arising from the knapsack problem. More precisely, they deﬁned for any integer lattice L in Zn , the orthogonal lattice L⊥ as the set of integral vectors orthogonal to L, that is, the set of x ∈ Zn such that the dot product x, y = 0 for all y ∈ L. Note that the lattice L⊥ has dimension n − dim(L), and can be computed in polynomial time from L (see [36]). Interestingly, the links between duality and orthogonality (see Martinet’s book [92, pages 34–35]) enable to prove that the volume of L⊥ is equal to the volume of the lattice span(L) ∩ Zn which ¯ Thus, if a lattice in Zn is low-dimensional, its orthogonal lattice we denote by L. is high-dimensional with a volume at most equal: the successive minima of the orthogonal lattice are likely to be much shorter than the ones of the original lattice. That property of orthogonal lattices has led to eﬀective (though heuristic) lattice-based attacks on various cryptographic schemes [113,115,116,114,117]. We refer to [109] for more information. In particular, it was used in [117] to solve the hidden subset sum problem (used in [26]) in low density. The hidden subset sum problem was apparently a non-linear version of the subset sum problem: given M and n in N, and b1 , . . . , bm ∈ ZM , ﬁnd α1 , . . . , αn ∈ ZM such that each bi is some subset sum modulo M of α1 , . . . , αn . We sketch the solution of [117] to give a ﬂavour of cryptanalyses based on orthogonal lattices. We ﬁrst restate the hidden subset sum problem in terms of vectors. We are given an integer M , and a vector b = (b1 , . . . , bm ) ∈ Zm with entries in [0..M − 1] such that there exist integers α1 , . . . , αn ∈ [0..M − 1], and vectors x1 , . . . , xn ∈ Zm with entries in {0, 1} satisfying: b = α1 x1 + α2 x2 + · · · + αn xn (mod M ). We want to determine the αi ’s. There exists a vector k ∈ Zm such that: b = α1 x1 + α2 x2 + · · · + αn xn + M k. Notice that if u in Zn is orthogonal to b, then pu = (u, x1 , . . . , u, xn , u, k) is orthogonal to the vector vα = (α1 , . . . , αn , M ). But vα is independent of m, ⊥ . On the other hand, as m grows for a and so is the n-dimensional lattice vα

156

Phong Q. Nguyen and Jacques Stern

ﬁxed M , most of the vectors of any reduced basis of the (m − 1)-dimensional have norm close lattice b⊥ should get shorter and shorter, because they should √ to vol(b⊥ )1/(m−1) ≤ vol(b)1/(m−1) = b1/(m−1) ≈ (M m)1/(m−1) . For such vectors u, the corresponding vectors pu also get shorter and shorter. But if pu ⊥ gets smaller than λ1 (vα ) (which is independent of m), then it is actually zero, ⊥ ) to that is, u is orthogonal to all the xj ’s and k. Note that one expects λ1 (vα √ 1/n 1/n ≈ (M n) . be of the order of vα This suggests that if (u1 , . . . , um−1 ) is a suﬃciently reduced basis of b⊥ , then the ﬁrst m − (n + 1) vectors u1 , . . . , um−(n+1) should heuristically be orthogonal to all the xj ’s and k. One cannot expect that more than m − (n + 1) vectors are orthogonal because the lattice Lx spanned by the xj ’s and k is likely to have dimension (n + 1). From the previous discussion, one can hope that the heuristic condition is satisﬁed when the density n/ log(M ) is very small (so ⊥ ) is not too small), and m is suﬃciently large. And if the heuristic that λ1 (vα ¯ x is disclosed, because it is then equal to the condition is satisﬁed, the lattice L ¯ x is known, it is not diﬃcult to orthogonal lattice (u1 , . . . , um−(n+1) )⊥ . Once L recover (heuristically) the vectors xj ’s by lattice reduction, because they are very short vectors. One eventually determines the coeﬃcients αj ’s from a linear modular system. The method is quite heuristic, but it works in practice for small parameters in low density (see [117] for more details). 3.4

Multivariate Modular Linear Equations

The technique described in Section 3.2 to solve the knapsack problem can easily be extended to ﬁnd small solutions of a system of multivariate linear equations over the integers: one views the problem as a closest vector problem in the lattice corresponding to the homogenized equations, which is an orthogonal lattice. Naturally, a similar method can be applied to a system of multivariate linear modular equations, except that in this case, the corresponding lattice is not an orthogonal lattice. Let A = (ai,j ) be an × k integral matrix, c ∈ Z be a column vector and q be a prime number. The problem is to ﬁnd a short column vector x ∈ Zk such that: Ax ≡ c (mod q). The interesting case is when the number of unknowns k is larger than the number of equations . Following Section 3, one computes an arbitrary solution y ∈ Zk such that Ay ≡ c (mod q), for instance by ﬁnding a solution of a solvable system of linear equations over the integers (if the system is not solvable, then the original problem has no solution). And one computes a basis of the fulldimensional lattice L of all column vectors z ∈ Zk such that Az ≡ 0

(mod q).

Then any short solution x to Ax ≡ c (mod q) corresponds to a lattice vector y − x ∈ L close to y. Thus, there is at most one x ∈ Zk such that Ax ≡ c (mod q) and x < L/2. And if ever there is an unusually short vector x ∈ Zk

The Two Faces of Lattices in Cryptology

157

such that Ax ≡ c (mod q) and x < L2−k/2−1, then Babai’s CVP approximation algorithm will disclose it, as in Section 3. It remains to lower bound the ﬁrst minimum of the lattice. One can see that the volume of L is an integer dividing q , because it is the index of L in Zk . In fact, for most matrices A, one expects the volume to be exactly q , so that:

k /k L ≈ q . 2πe This estimate is not far from the truth, since for any ﬁxed non-zero vector z ∈ Zk such that x∞ < q, the probability that z ∈ L (when A is uniformly distributed) is exactly q − . It follows that for most matrices, if ever there exists x ∈ Zk such that Ax ≡ c (mod q) and x roughly less than q /k 2−k/2−1 , then one can ﬁnd such an x in polynomial time. For a precise statement, we refer to [52] who actually used a dual approach requiring transference theorems (which we do not need here). An interesting application is that if we know a few bits of each entry of an arbitrary solution x of a system of linear modular equations, then we can recover all of x, because if the number of bits is suﬃciently large, the problem is reduced to ﬁnding an unusually short solution of a system of linear modular equations. This was used to show the insecurity of truncated linear congruential pseudo-random number generators in [52]. The result can in fact be extended to a wider class of parameters, when the modulus q is not necessarily prime (see [52]), and when the equations may have diﬀerent modulus (see [10]). We note that the exponent −k/2 can be suppressed when a CVP-oracle is available, which is the case when k is ﬁxed. Furthermore, the previous reasoning not only shows how to ﬁnd unusually short solutions, it also shows how to ﬁnd reasonably short solutions when the matrix A is random. Indeed, a tighter analysis thenshows that all the minima of the lattice L are in fact not too far away from k/(2πe)q /k , so that all points are reasonably k close to the lattice. In this case, one can ﬁnd in polynomial time a vector x ∈ Z such that Ax ≡ c (mod q) and x is very roughly less than k/(2πe)q /k 2k/2 . This was used to attack certain RSA padding signature schemes in which the messages have a ﬁxed pattern (see [104,57]), and it was also used to complete the proof of security of the RSA–OAEP encryption scheme (see [53]). However, the previous results are weak in a certain sense. First, the results depend strongly on the distribution of the coeﬃcients of the linear equations. More precisely, the ﬁrst minimum of the lattice can be arbitrary small, leading to possibly much weaker bounds: hence, one must perform a new analysis of the lattice for any system of equations which is not uniformly distributed. This was the case in [52] where linear congruential generators gave rise to special systems of equations. Furthermore, the exponential or slightly subexponential factors in the polynomial-time approximation of CVP imply that the bounds obtained are rather weak as the number k of unknowns increases. The situation is somewhat similar to that of knapsacks for which only knapsacks of very low density can provably be solved. This is one of the reasons why the attack of [104] was only

158

Phong Q. Nguyen and Jacques Stern

heuristic. On the other hand, k was as small as 2 in [53], making provable results useful. We will see in the next section a particular case of a system of linear modular equations for which the generic method can be replaced by another lattice-based method.

4 4.1

The Hidden Number Problem Hardness of Diﬃe-Hellman Bits

In [24], Boneh and Venkatesan used the LLL algorithm to solve the hidden number problem, which enables to prove the hardness of the most signiﬁcant bits of secret keys in Diﬃe-Hellman and related schemes in prime ﬁelds. This was the ﬁrst positive application of LLL in cryptology. Recall the Diﬃe-Hellman key exchange protocol [43]: Alice and Bob ﬁx a ﬁnite cyclic G and a generator g. They respectively pick random a, b ∈ [1, |G|] and exchange g a and g b . The secret key is g ab . Proving the security of the protocol under “reasonable” assumptions has been a challenging problem in cryptography (see [15]). Computing the most signiﬁcant bits of g ab is as hard as computing g ab itself, in the case of prime ﬁelds: Theorem 2 (Boneh-Venkatesan). Let q be an n-bit √ prime and g be a generator of Z∗q . Let ε > 0 be ﬁxed, and set = (n) = ε n. Suppose there exists an expected polynomial time (in n) algorithm A, that on input q, g, g a and g b , outputs the most signiﬁcant bits of g ab . Then there is also an expected polynomial time algorithm that on input q, g, g a , g b and the factorization of q − 1, computes all of g ab . The above result is slightly diﬀerent from [24], due to an error in the proof of [24] spotted by [63]. The same result holds for the least signiﬁcant bits. For a more general statement when g is not necessarily a generator, and the factorization of q − 1 is unknown, see [63]. For analogous results in other groups, we refer to [136] for ﬁnite ﬁelds and to [23] for the elliptic curve case. The proof goes as follows. We are given some g a and g b , and want to compute ab g . We repeatedly pick a random r until g a+r is a generator of Z∗q (testing is easy thanks to the factorization of q − 1). For each r, the probability of success is φ(q − 1)/(q − 1) ≥ C/ log log q. Next, we apply A to the points g a+r and g b+t for many random values of t, so that we learn the most signiﬁcant bits of g (a+r)b g (a+r)t , where g (a+r)t is a random element of Z∗q since g a+r is a generator. Note that one can easily recover g ab from α = g (a+r)b . The problem becomes the hidden number problem (HNP): given t1 , . . . , td chosen uniformly and independently at random in Z∗q , and MSB (αti mod q) for all i, recover α ∈ Zq . Here, MSB (x) for x ∈ Zq denotes any integer z satisfying |x − z| < q/2+1 . To achieve the proof, Boneh and Venkatesan presented a simple solution to HNP when is not too small, by reducing HNP to a lattice closest vector problem. We sketch this solution in the next section.

The Two Faces of Lattices in Cryptology

4.2

159

Solving the Hidden Number Problem by Lattice Reduction

Consider an HNP-instance: let t1 , . . . , td be chosen uniformly and independently at random in Z∗q , and ai = MSB (αti mod q) where α ∈ Zq is hidden. Clearly, the vector t = (t1 α mod q, . . . td α mod q, α/2+1 ) belongs to the (d + 1)-dimensional lattice L = L(q, , t1 , . . . , td ) spanned by the rows of the following matrix:   q 0 ··· 0 0  . ..   0 q . . . .. .     . . . . ..   .. . . . . 0   0 ... 0 q 0  t1 . . . . . . td 1/2+1 The vector a = (a1√ , . . . , ad , 0) is very close to L, because it is very close to t. Indeed, t − a ≤ q d + 1/2+1 . It is not diﬃcult to show that any lattice point suﬃciently close to a discloses the hidden number α, because suﬃciently short lattice vectors must have their ﬁrst d coordinates equal to zero (see [24, Theorem 5] or [110,112]): √ √ Lemma 3 (Uniqueness). Set d = 2 log q and µ = 12 log q + 3. Let α be in Z∗q . Choose integers t1 , . . . , td uniformly and independently at random in Z∗q . Let a = (a1 , . . . , ad , 0) be such that |(αti mod q) − ai | < q/2µ . Then with probability at least 12 , all u ∈ L with u − a < 2qµ are of the form: u = (t1 β mod q, . . . td β mod q, β/2+1 ) where α ≡ β

(mod q).

Since a is close enough to L, Babai’s nearest plane CVP approximation algorithm [8] yields a lattice point suﬃciently close to a, which leads to: Theorem 4 (Boneh-Venkatesan). Let α be in Z∗q . Let O be a function de√ ﬁned by O(t) = MSB (αt mod q) with = log q + log log q. There exists a deterministic polynomial time algorithm A which, on input t1 , . . . , td , t1 , . . . , td chosen O(t1 ), . . . , O(td ), outputs α with probability at least 1/2 over √ uniformly and independently at random from Z∗q , where d = 2 log q. √ Thus, the hidden number problem can be solved using = log q + log log q bits. Using the best polynomial-time CVP √ approximation algorithm known, this can be asymptotically improved to O( log q log log log q/ log log q). Theorem 2 is a simple consequence. We note that Theorem 4 could have alternatively be obtained from the generic method described in Section 3.4. Indeed, the hidden number problem can be viewed as a system of d modular linear equations in the d + 1 unknowns α and (αti mod q) − MSB (αti mod q) where 1 ≤ i ≤ d. Among these d + 1 unknowns, only α may be large. One may transform the system to eliminate the possibly large unknown α. One then obtains a new system of d − 1 modular linear equations in the d unknowns (αti mod q) − MSB (αti mod q) all smaller than q/2+1 in absolute value. Although this system does not correspond to a uniformly distributed matrix, one can easily obtain the same lower bound on the

160

Phong Q. Nguyen and Jacques Stern

ﬁrst minimum of the lattice as in the random case (see Section 3.4). It follows that one can ﬁnd the (unique) small solution of the system in polynomial time (and thus, α) provided that roughly: q 2+1

≤ q (d−1)/d 2−d/2−1 ,

that √ is ≥ d/2 + 1 + log(q)/d, where the right-hand term is minimized for √ d ≈ 2 log q, leading to larger than roughly 2 log q. Thus, one can obtain essentially the same bounds. 4.3

Variants of the Hidden Number Problem

It was recently realized that the condition that the ti ’s are uniformly distributed is often too restrictive for applications. The previous solution to the hidden number problem can in fact be extended to cases where the distribution of the ti ’s is not necessarily perfectly uniform (see [63,111]). A precise deﬁnition of this relaxed uniformity property can be made with the classical notion of discrepancy (see [111] for more details). To apply the solution to this generalized hidden number problem, it suﬃces to show that the distribution of the ti ’s is suﬃciently uniform, which is usually obtained by exponential sum techniques (see [63,111,112,48,130,129] for some examples). One may also extend the solution to the hidden number problem to the case when an oracle for CVP (in the Euclidean norm or the inﬁnity norm) is available, which signiﬁcantly decreases the number of necessary bits (see [110,111]). This is useful to estimate what can be achieved in practice, especially when the lattice dimension is small. It turns out that the required number of bits becomes O(log log q) and 2 respectively, with a CVP-oracle and a CVP∞ -oracle. One may also study the hidden number problem with arbitrary bits instead of most signiﬁcant bits. It is easy to see that the HNP with least signiﬁcant bits can be reduced to the original HNP with most signiﬁcant bits, but the situation worsens with arbitrary bits. By multiplying the ti ’s with an appropriate number independent of the ti ’s (see [111]), one obtains a deterministic polynomial-time reduction from the HNP with consecutive bits at a known position to the original HNP with /2 most signiﬁcant bits (the prime ﬁeld Zq and the number of random multipliers remain the same). This appropriate number can be found either by continued fractions or lattice reduction in dimension 2. More generally, by using high-dimensional lattice reduction, it is not diﬃcult to show that there is a deterministic polynomial-time reduction from the HNP with arbitrary bits at known positions such that the number of blocks of consecutive unknown bits is m, to the original HNP with /m + 1 − log m most signiﬁcant bits. Thus, the HNP with arbitrary bits seems to be harder, especially when there are many blocks of consecutive unknown bits. Finally, variants of the hidden number problem in settings other than prime ﬁelds have been studied in [130,129,23].

The Two Faces of Lattices in Cryptology

4.4

161

Lattice Attacks on DSA

Interestingly, the previous solution of the hidden number problem also has a dark side: it leads to a simple attack against the Digital Signature Algorithm [106,95] (DSA) in special settings (see [73,110]). Recall that the DSA uses a public element g ∈ Zp of order q, a 160-bit prime dividing p−1 where p is a large prime (at least 512 bits). The signer has a secret key α ∈ Z∗q and a public key β = g α mod p. The DSA signature of a message m is (r, s) ∈ Z2q where r = (g k mod p) mod q, s = k −1 (h(m) + αr) mod q, h is SHA-1 hash function and k is a random element in Z∗q chosen at each signature. It is well-known that the secret key α can easily be recovered if the random nonce k is disclosed, or if k is produced by a cryptographically weak pseudorandom generator such as a linear congruential generator with known parameters [10] and a few signatures are available. Recently, Howgrave-Graham and Smart [73] noticed that Babai’s nearest plane CVP algorithm could heuristically recover α, provided that suﬃciently many signatures and suﬃciently many bits of the corresponding nonces k are known. This is not surprising, because the underlying problem is in fact a generalized hidden number problem. Indeed, assume that for d signatures (ri , si ) of messages mi , the least significant bits of the random nonce ki are known to the attacker: one knows ai < 2 such that ki − ai is of the form 2 bi . Then αri ≡ si (ai + bi 2 ) − h(mi ) (mod q), − ≡ (ai − s−1 + bi (mod q). which can be rewritten as: αri 2− s−1 i i h(mi )) · 2 − −1 Letting ti = ri 2 si mod q, one sees that MSB (αti mod q) is known. Recovering the secret key α is therefore a generalized hidden number problem in which the ti ’s are not assumed to be independent and uniformly distributed over Zq , but are of the form ri 2− s−1 where the underlying ki ’s are independent and i uniformly distributed over Z∗q . Nguyen and Shparlinski [111] proved that under a reasonable assumption on the hash function, the ti ’s are suﬃciently uniform to make the corresponding hidden number problem provably √ tractable with the same number of bits as in Theorem 4, that is, essentially log q. Since lattice reduction algorithms can behave much better than theoretically expected, one may even hope to solve CVP exactly, yielding better bounds to Theorem 4. For the case of a 160-bit prime q as in DSA, one obtains that the DSA–HNP can be solved using respectively = 2 bits and d = 160, or = 6 bits and d = 100 respectively, when an oracle for CVP∞ or CVP is available (see [110,112]). In fact, the bounds are better in practice. It turns out that using standard lattice reduction algorithms implemented in Shoup’s NTL library [127], one can often solve HNP for a 160-bit prime q using = 3 bits and d = 100 (see [110,112]). Naturally, this attack can also be applied to similar signature algorithms (see [111]), such as the elliptic curve variant of DSA (see [112]), or the NybergRueppel signature scheme and related schemes (see [48]). The only diﬀerence is that one needs to establish the uniformity of diﬀerent types of multipliers. This usually requires diﬀerent kinds of exponential sums.

162

5

Phong Q. Nguyen and Jacques Stern

Lattice-Based Cryptography

We review state-of-the-art results on the main lattice-based cryptosystems. To keep the presentation simple, descriptions of the schemes are intuitive, referring to the original papers for more details. Only one of these schemes (the GGH cryptosystem [61]) explicitly works with lattices. 5.1

The Ajtai-Dwork Cryptosystem

Description. The Ajtai-Dwork cryptosystem [5] (AD) works in Rn , with some ﬁnite precision depending on n. Its security is based on a variant of SVP. The private key is a uniformly chosen vector u in the n-dimensional unit ball. One then deﬁnes a distribution Hu of points a in a large n-dimensional cube such that the dot product a, u is very close to Z. The public key is obtained by picking w1 , . . . , wn , v1 , . . . , vm (where m = n3 ) independently at random from the distribution Hu , subject to the constraint that the parallelepiped w spanned by the wi ’s is not ﬂat. Thus, the public key consists of a polynomial number of points close to a collection of parallel aﬃne hyperplanes, which is kept secret. The scheme is mainly of theoretical purpose, as encryption is bit-by-bit. To encrypt a ’0’, one randomly selects b1 , . . . , bm in {0, 1}, and reduces m i=1 bi vi modulo the parallelepiped w. The vector obtained is the ciphertext. The ciphertext of ’1’ is just a randomly chosen vector in the parallelepiped w. To decrypt a ciphertext x with the private key u, one computes τ = x, u. If τ is suﬃciently close to Z, then x is decrypted as ’0’, and otherwise as ’1’. Thus, an encryption of ’0’ will always be decrypted as ’0’, and an encryption of ’1’ has a small probability to be decrypted as ’0’. These decryption errors can be removed (see [60]). Security. The Ajtai-Dwork [5] cryptosystem received wide attention due to a surprising security proof based on worst-case assumptions. Indeed, it was shown that any probabilistic algorithm distinguishing encryptions of a ’0’ from encryptions of a ’1’ with some polynomial advantage can be used to solve SVP in any n-dimensional lattice with gap λ2 /λ1 larger than n8 . There is a converse, due to Nguyen and Stern [115]: one can decrypt in polynomial time with high probability, provided an oracle that approximates SVP to within n0.5−ε , or one that approximates CVP to within n1.33 . It follows that the problem of decrypting ciphertexts is unlikely to be NP-hard, due to the result of GoldreichGoldwasser [58]. Nguyen and Stern [115] further presented a heuristic attack to recover the secret key. Experiments suggest that the attack is likely to succeed up to at least n = 32. For such parameters, the system is already impractical, as the public key requires 20 megabytes and the ciphertext for each bit has bit-length 6144. This shows that unless major improvements3 are found, the Ajtai-Dwork cryptosystem is only of theoretical importance. 3

A variant of AD with less message expansion was proposed in [32], however without any security proof. It mixes AD with a knapsack.

The Two Faces of Lattices in Cryptology

163

Cryptanalysis Overview. At this point, the reader might wonder how lattices come into play, since the description of AD does not involve lattices. Any ciphertext of ’0’ is a sum of vi ’s minus some integer linear combination of the wi ’s. Since the parallelepiped spanned by the wi ’s is not too ﬂat, the coeﬃcients of the linear combination are relatively small. On the other hand, any linear combination of the vi ’s and the wi ’s with small coeﬃcients is close to the hidden hyperplanes. This enables to build a particular lattice of dimension n + m such that any ciphertext of ’0’ is in some sense close to the lattice, and reciprocally, any point suﬃciently close to the lattice gives rise to a ciphertext of ’0’. Thus, one can decrypt ciphertexts provided an oracle that approximates CVP suﬃciently well. The analogous version for SVP uses related ideas, but is technically more complicated. For more details, see [115]. The attack to recover the secret key can be described quite easily. One knows that each vi , u is close to some unknown integer Vi . It can be shown that any suﬃciently short linear combination of the vi ’s give information on the Vi ’s. More precisely, if i λi vi is suﬃciently short and the λi ’s are suﬃciently small, then i λi Vi = 0 (because it is a too small integer). Note that the Vi ’s are disclosed if enough such equations are found. And each Vi gives an approximate linear equation satisﬁed by the coeﬃcients of the secret key u. Thus, one can compute a suﬃciently good approximation of u from the Vi ’s. To ﬁnd the Vi ’s, we produce many short combinations i λi vi with small λi ’s, using lattice reduction. Heuristic arguments can justify that there exist enough such combinations. Experiments showed that the assumption was reasonable in practice. 5.2

The Goldreich-Goldwasser-Halevi Cryptosystem

The Goldreich-Goldwasser-Halevi cryptosystem [61] (GGH) can be viewed as a lattice-analog to the McEliece [94] cryptosystem based on algebraic coding theory. In both schemes, a ciphertext is the addition of a random noise vector to a vector corresponding to the plaintext. The public key and the private key are two representations of the same object (a lattice for GGH, a linear code for McEliece). The private key has a particular structure allowing to cancel noise vectors up to a certain bound. However, the domains in which all these operations take place are quite diﬀerent. Description. The GGH scheme works in Zn . The private key is a non-singular n × n integral matrix R, with very short row vectors4 (entries polynomial in n). The lattice L is the full-dimensional lattice in Zn spanned by the rows of R. The basis R is then transformed to a non-reduced basis B, which will be public. In the original scheme, B is the multiplication of R by suﬃciently many small unimodular matrices. Computing a basis as “good” as the private basis R, given only the non-reduced basis B, means approximating SBP. The message space is a “large enough” cube in Zn . A message m ∈ Zn is encrypted into c = mB + e where e is an error vector uniformly chosen from {−σ, σ}n , where σ is a security parameter. A ciphertext c is decrypted as 4

A diﬀerent construction for R based on tensor product was proposed in [50].

164

Phong Q. Nguyen and Jacques Stern

cR−1 RB −1 (note: this is Babai’s round method [8] to solve CVP). But an eavesdropper is left with the CVP-instance deﬁned by c and B. The private basis R is generated in such a way that the decryption process succeeds with high probability. The larger σ is, the harder the CVP-instances are expected to be. But σ must be small for the decryption process to succeed. Improvements. In the original scheme, the public matrix B is the multiplication of the secret matrix by suﬃciently many unimodular matrices. This means that without appropriate precaution, the public matrix may be as large as O(n3 log n) bits. Micciancio [99,101] therefore suggested to deﬁne instead B as the Hermite normal form (HNF) of R. Recall that the HNF of an integer square matrix R in row notation is the unique lower triangular matrix with coeﬃcients in N such that: the rows span the same lattice as R, and any entry below the diagonal is strictly less than the diagonal entry in its column. Here, one can see that the HNF of R is O(n2 log n) bits, which is much better but still big. When using the HNF, one should encode messages into the error vector e instead of a lattice point, because the HNF is unbalanced. The ciphertext is deﬁned as the reduction of e modulo the HNF, and hence uses less than O(n log n) bits. One can easily prove that the new scheme (which is now deterministic) cannot be less secure than the original GGH scheme (see [99,101]). Security. GGH has no proven worst-case/average-case property, but it is much more eﬃcient than AD. Speciﬁcally, for security parameter n, key-size and encryption time can be O(n2 log n) for GGH (note that McEliece is slightly better though), vs. at least O(n4 ) for AD. For RSA and El-Gamal systems, key size is O(n) and computation time is O(n3 ). The authors of GGH argued that the increase in size of the keys was more than compensated by the decrease in computation time. To bring conﬁdence in their scheme, they published on the Internet a series of ﬁve numerical challenges [59], in dimensions 200, 250, 300, 350 and 400. In each of these challenges, a public key and a ciphertext were given, and the challenge was to recover the plaintext. The GGH scheme is now considered broken, at least in its original form, due to an attack recently developed by Nguyen [108]. As an application, using small computing power and Shoup’s NTL library [127], Nguyen was able to solve all the GGH challenges, except the last one in dimension 400. But already in dimension 400, GGH is not very practical: in the 400-challenge, the public key takes 1.8 Mbytes without HNF or 124 Kbytes using the HNF.5 Nguyen’s attack used two “qualitatively diﬀerent” weaknesses of GGH. The ﬁrst one is inherent to the GGH construction: the error vectors used in the encryption process are always much shorter6 than lattice vectors. This makes CVP-instances arising from GGH easier than general CVP-instances. The second 5 6

The challenges do not use the HNF, as they were proposed before [99]. Note that 124 Kbytes is about twice as large as McEliece for the recommended parameters. In all GGH-like constructions known, the error vector is always at least twice as short.

The Two Faces of Lattices in Cryptology

165

weakness is the particular form of the error vectors in the encryption process. Recall that c = mB+e where e ∈ {±σ}n . The form of e was apparently chosen to maximize the Euclidean norm under requirements on the inﬁnity norm. However, if we let s = (σ, . . . , σ) then c + s ≡ mB (mod 2σ), which allows to guess m mod 2σ. Then the original closest vector problem can be reduced to ﬁnding a lattice vector within (smaller) distance e/(2σ) from (c − (m mod 2σ)B)/(2σ). The simpliﬁed closest vector problem happens to be within reach (in practice) of current lattice reduction algorithms, thanks to the embedding strategy that heuristically reduces CVP to SVP. We refer to [108] for more information. It is easy to ﬁx the second weakness by selecting the entries of the error vector e at random in {−σ, . . . , +σ} instead of {±σ}. However, one can argue that the resulting GGH system would still not be much practical, even using [99,101]. Indeed, Nguyen’s experiments [108] showed that SVP could be solved in practice up to dimensions as high as 350, for (certain) lattices with gap as small as 10. To be competitive, the new GGH system would require the hardness (in lower dimensions due to the size of the public key, even using [99]) of SVP for certain lattices of only slightly smaller gap, which means a rather smaller improvement in terms of reduction. Note also that those experiments do not support the practical hardness of Ajtai’s variant of SVP in which the gap is polynomial in the lattice dimension. Besides, it is not clear how to make decryption eﬃcient without a huge secret key (Babai’s rounding requires the storage of R−1 or a good approximation, which could be in [61] over 1 Mbytes in dimension 400). 5.3

The NTRU Cryptosystem

Description. The NTRU cryptosystem [69], proposed by Hoﬀstein, Pipher and Silverman, works in the ring R = Z[X]/(X N − 1). An element F ∈ R is seen as −1 i a polynomial or a row vector: F = N i=0 Fi x = [F0 , F1 , . . . , FN −1 ]. To select keys, one uses the set L(d1 , d2 ) of polynomials F ∈ R such that d1 coeﬃcients are equal to 1, d2 coeﬃents are equal to -1, and the rest are zero. There are two small coprime moduli p < q : a possible choice is q = 128 and p = 3. There are also three integer parameters df , dg and dφ quite a bit smaller than the prime number N (which is around a few hundreds). The private keys are f ∈ L(df , df − 1) and g ∈ L(dg , dg ). With high probability, f is invertible mod q. The public key h ∈ R is deﬁned as h = g/f mod q. A message m ∈ {−(p − 1)/2 · · · + (p − 1)/2}N is encrypted into: e = (pφ ∗ h + m) mod q, where φ is randomly chosen in L(dφ , dφ ). The user can decrypt thanks to the congruence e ∗ f ≡ pφ ∗ g + m ∗ f (mod q), where the reduction is centered (one takes the smallest residue in absolute value). Since φ, f , g and m all have small coeﬃcients and many zeroes (except possibly m), that congruence is likely to be a polynomial equality over Z. By further reducing e ∗ f modulo p, one thus recovers m ∗ f mod q, hence m. Security. The best attack known against NTRU is based on lattice reduction, but this does not mean that lattice reduction is necessary to break NTRU. The simplest lattice-based attack can be described as follows. Coppersmith and

166

Phong Q. Nguyen and Jacques Stern

Shamir [40] noticed that the target vector f g ∈ Z2N (the symbol denotes vector concatenation) belongs to the following natural lattice: LCS = {F G ∈ Z2N | F ≡ h ∗ G

mod q where F, G ∈ R}.

It is not diﬃcult to see that LCS is a full-dimensional lattice in Z2N , with volume q N . The volume suggests that the target vector is a shortest vector of LCS (but with small gap), so that a SVP-oracle should heuristically output the private keys f and g. However, based on numerous experiments with Shoup’s NTL library [127], the authors of NTRU claimed in [69] that all such attacks are exponential in N , so that even reasonable choices of N ensure suﬃcient security. The parameter N must be prime, otherwise the lattice attacks can be improved due to the factorization of X N − 1 (see [56]). Note that the keysize of NTRU is only O(N log q), which makes NTRU the leading candidate among knapsackbased and lattice-based cryptosystems, and allows high lattice dimensions. It seems that better attacks or better lattice reduction algorithms are required in order to break NTRU. To date, none of the numerical challenges proposed in [69] has been solved. However, it is probably too early to tell whether or not NTRU is secure. Note that NTRU, like RSA, should only be used with appropriate preprocessing. Indeed, NTRU without padding cannot be semantically secure since e(1) ≡ m(1) (mod q) as polynomials, and it is easily malleable using multiplications by X of polynomials (circular shifts). And there exist simple chosen ciphertext attacks [74] that can recover the secret key.

6

Finding Small Roots of Low-Degree Polynomial Equations

We survey an important application of lattice reduction found in 1996 by Coppersmith [38,39], and its developments. These results illustrate the power of linearization combined with lattice reduction. 6.1

Univariate Modular Equations

The general problem of solving univariate polynomial equations modulo some integer N of unknown factorization seems to be hard. Indeed, notice that for some polynomials, it is equivalent to the knowledge of the factorization of N . And the particular case of extracting e-th roots modulo N is the problem of decrypting ciphertexts in the RSA cryptosystem, for an eavesdropper. Curiously, Coppersmith [38] showed using LLL that the special problem of ﬁnding small roots is easy: Theorem 5 (Coppersmith). Let P be a monic polynomial of degree δ in one variable modulo an integer N of unknown factorization. Then one can ﬁnd in time polynomial in (log N, δ) all integers x0 such that P (x0 ) ≡ 0 (mod N ) and |x0 | ≤ N 1/δ .

The Two Faces of Lattices in Cryptology

167

Related (but weaker) results appeared in the eighties [66,133].7 Incidentally, the result implies that the number of roots less than N 1/δ is polynomial, which was also proved in [81] (using elementary techniques). We sketch a proof of Theorem 5, in the spirit of Howgrave-Graham [70], who simpliﬁed Coppersmith’s original proof (see also [76]) by working in the dual lattice of the lattice originally considered by Coppersmith. More details can be found in [39]. Coppersmith’s method reduces the problem of ﬁnding small modular roots to the (easy) problem of solving polynomial equations over Z. More precisely, it applies lattice reduction to ﬁnd an integral polynomial equation satisﬁed by all small modular roots of P . The intuition is to linearize all the equations of the form xi P (x)j ≡ 0 (mod N j ) for appropriate integral values of i and j. Such equations are satisﬁed by any solution of P (x) ≡ 0 (mod N ). Small solutions x0 give rise to unusually short solutions to the resulting linear system. To transform modular equations into integer equations, the following elementary 8 2 for any polynomial r(x) = is used, with the notation r(x) = a lemma i ai xi ∈ Q[x]: Lemma 6. Let r(x) ∈ Q[x] be a√polynomial of degree < n and let X be a positive integer. Suppose r(xX) < 1/ n. If r(x0 ) ∈ Z with |x0 | < X, then r(x0 ) = 0 holds over the integers. This is just because any suﬃciently small integer must be zero. Now the trick is to, given a parameter h, consider the n = (h + 1)δ polynomials qu,v (x) = xu (P (x)/N )v , where 0 ≤ u ≤ δ − 1 and 0 ≤ v ≤ h. Notice that the degree of qu,v (x) is strictly less than n, and that the evaluation of qu,v (x) at any root x0 of P (x) modulo N is necessarily an integer. The same is true for any integral linear combination r(x) √ of the qu,v (x)’s. If such a combination r(x) further satisﬁes r(xX) < 1/ n, then by Lemma 6, solving the equation r(x) = 0 over Z yields all roots of P (x) modulo N less than X in absolute value. This suggests to look for a short vector in the lattice corresponding to the qu,v (xX)’s. More precisely, deﬁne the n× n matrix M whose i-th row consists of the coeﬃcients of qu,v (xX), starting by the low-degree terms, where v = (i − 1)/δ and u = (i − 1) − δv. Notice that M is lower triangular, and a simple calculation leads to det(M ) = X n(n−1)/2 N −nh/2 . We apply an LLL-reduction to the full-dimensional lattice spanned by the rows of M . The ﬁrst vector of the reduced basis corresponds to a polynomial of the form r(xX), and has Euclidean norm r(xX). The theoretical bounds of the LLL algorithm ensure that: r(xX) ≤ 2(n−1)/4 det(M )1/n = 2(n−1)/4 X (n−1)/2 N −h/2 . √ Recall that we need r(xX) ≤ 1/ n to apply the lemma. Hence, for a given h, the method is guaranteed to ﬁnd modular roots up to X if: 1 X ≤ √ N h/(n−1) n−1/(n−1) . 2 7

8

H˚ astad [66] presented his result in terms of system of low-degree modular equations, but he actually studies the same problem, and his approach achieves the weaker bound N 2/(δ(δ+1)) . A similar lemma is used in [66]. Note also the resemblance with [88, Prop. 2.7].

168

Phong Q. Nguyen and Jacques Stern

The limit of the upper bound, when h grows to ∞, is √12 N 1/δ . Theorem 5 follows from an appropriate choice of h. This result is practical (see [42,71] for experimental results) and has many applications. It can be used to attack RSA encryption when a very low public exponent is used (see [16] for a survey). Boneh et al. [21] applied it to factor eﬃciently numbers of the form N = pr q for large r. Boneh [17] used a variant to ﬁnd smooth numbers in short interval. See also [13] for an application to Chinese remaindering in the presence of noise, and [72] to ﬁnd approximate integer common divisors. Curiously, Coppersmith’s theorem was also recently used in security proofs of factoring-based schemes (see [128,18]). Remarks. Theorem 5 is trivial if P (x) = xδ + c. Note also that one cannot hope to improve the (natural) bound N 1/δ for all polynomials and all moduli N . Indeed, for the polynomial P (x) = xδ and N = pδ where p is prime, the roots of P mod N are the multiples of p. Thus, one cannot hope to ﬁnd all the small roots (slightly) beyond N 1/δ = p, because there are too many of them. This suggests that even an SVP-oracle (instead of LLL) should not help Theorem 5 in general, as evidenced by the value of the lattice volume (the fudge factor 2(n−1)/4 yielded by LLL is negligible compared to det(M )1/n ). It was recently noticed in [13] that if one only looks for the smallest root mod N , an SVP-oracle can improve the bound N 1/δ for very particular moduli (namely, squarefree N of known factorization, without too small factors). Note that in such cases, ﬁnding modular roots can still be diﬃcult, because the number of modular roots can be exponential in the number of prime factors of N . Coppersmith discusses potential improvements in [39]. 6.2

Multivariate Modular Equations

Interestingly, Theorem 5 can heuristically extend to multivariate polynomial modular equations. Assume for instance that one would like to ﬁnd all small roots of P (x, y) ≡ 0 (mod N ), where P (x, y) has total degree δ and has at least one monic monomial xα y δ−α of maximal total degree. If one could obtain two algebraically independent integral polynomial equations satisﬁed by all sufﬁciently small modular roots (x, y), then one could compute (by resultant) a univariate integral polynomial equation satisﬁed by x, and hence ﬁnd eﬃciently all small (x, y). To ﬁnd such equations, one can use an analogue of lemma 6 2 to bivariate polynomials, with the (natural) notation r(x, y) = i,j ai,j for r(x, y) = i,j ai,j xi y j : Lemma 7. Let r(x, √ y) ∈ Q[x, y] be a sum of at most w monomials. Assume r(xX, yY ) < 1/ w for some X, Y ≥ 0. If r(x0 , y0 ) ∈ Z with |x0 | < X and |y0 | < Y , then r(x0 , y0 ) = 0 holds over the integers. By analogy, one chooses a parameter h and select r(x, y) as a linear combination of the polynomials qu1 ,u2 ,v (x, y) = xu1 y u2 (P (x, y)/N )v , where u1 + u2 + δv ≤ hδ and u1 , u2 , v ≥ 0 with u1 < α or u2 < δ − α. Such polynomials have total degree

The Two Faces of Lattices in Cryptology

169

less than hδ, and therefore are linear combinations of the n = (hδ + 1)(hδ + 2)/2 monic monomials of total degree ≤ δh. Due to the condition u1 < α or u2 < δ−α, such polynomials are in bijective correspondence with the n monic monomials (associate to qu1 ,u2 ,v (x, y) the monomial xu1 +vα y u2 +v(δ−α) ). One can represent the polynomials as n-dimensional vectors in such a way that the n × n matrix consisting of the qu1 ,u2 ,v (xX, yY )’s (for some ordering) is lower triangular with coeﬃcients N −v X u1 +vδ y u2 +v(δ−α) on the diagonal. Now consider the ﬁrst two vectors r1 (xX, yY ) and r2 (xX, yY ) of an LLLreduced basis of the lattice spanned by the rows of that matrix. Since the rational qu1 ,u2 ,v (x0 , y0 ) is actually an integer for any root (x0 , y0 )√of P (x, y) modulo N , we need r1 (xX, yY ) and r2 (xX, yY ) to be less than 1/ n to apply Lemma 7. A (tedious) computation of the triangular matrix determinant enables to prove that r1 (x, y) and r2 (x, y) satisfy that bound when XY < N 1/δ−ε and h is suﬃciently large (see [76]). Thus, one obtains two integer polynomial bivariate equations satisﬁed by all small modular roots of P (x, y). The problem is that, although such polynomial equations are linearly independent as vectors, they might be algebraically dependent, making the method heuristic. This heuristic assumption is unusual: many lattice-based attacks are heuristic in the sense that they require traditional lattice reduction algorithms to behave like SVP-oracles. An important open problem is to ﬁnd suﬃcient conditions to make Coppersmith’s method provable for bivariate (or multivariate) equations. Note that the method cannot work all the time. For instance, the polynomial x − y has clearly too many roots over Z2 and hence too many roots mod any N (see [38] for more general counterexamples). Such a result may enable to prove several attacks which are for now, only heuristic. Indeed, there are applications to the security of the RSA encryption scheme when a very low public exponent or a low private exponent is used (see [16] for a survey), and related schemes such as the KMOV cryptosystem (see [12]). In particular, the experimental evidence of [19,12,46] shows that the method is very eﬀective in practice for certain polynomials. Remarks. In the case of univariate polynomials, there was basically no choice over the polynomials qu,v (x) = xu (P (x)/N )v used to generate the appropriate univariate integer polynomial equation satisﬁed by all small modular roots. There is much more freedom with bivariate modular equations. Indeed, in the description above, we selected the indices of the polynomials qu1 ,u2 ,v (x, y) in such a way that they corresponded to all the monomials of total degree ≤ hδ, which form a triangle in Z2 when a monomial xi y j is represented by the point (i, j). This corresponds to the general case where a polynomial may have several monomials of maximal total degree. However, depending on the shape of the polynomial P (x, y) and the bounds X and Y , other regions of (u1 , u2 , v) might lead to better bounds. Assume for instance P (x, y) is of the form xδx y δy plus a linear combination of xi y j ’s where i ≤ δx , j ≤ δy and i + j < δx + δy . Intuitively, it is better to select the (u1 , u2 , v)’s to cover the rectangle of sides hδx and hδy instead of the previous triangle, by picking all qu1 ,u2 ,v (x, y) such that u1 + vδx ≤ hδx and

170

Phong Q. Nguyen and Jacques Stern

u2 + vδy ≤ hδy , with u1 < δx or u2 < δy . One can show that the polynomials r1 (x, y) and r2 (x, y) obtained from the ﬁrst two vectors of an LLL-reduced basis of the appropriate lattice satisfy Lemma 7, provided that h is suﬃciently large, and the bounds satisfy X δx Y δy ≤ N 2/3−ε . Boneh and Durfee [19] applied similar and other tricks to a polynomial of the form P (x, y) = xy + ax + b. This allowed better bounds than the generic bound, leading to improved attacks on RSA with low secret exponent (see also [46] for an extension to the trivariate case, useful when the RSA primes are unbalanced). 6.3

Multivariate Integer Equations

The general problem of solving multivariate polynomial equations over Z is also hard, as integer factorization is a special case. Coppersmith [38] showed that a similar9 lattice-based approach can be used to ﬁnd small roots of bivariate polynomial equations over Z: Theorem 8 (Coppersmith). Let P (x, y) be a polynomial in two variables over Z, of maximum degree δ in each variable separately, and assume the coeﬃcients of f are relatively prime as a set. Let X, Y be bounds on the desired solutions x0 , y0 . Deﬁne Pˆ (x, y) = P (Xx, Y y) and let D be the absolute value of the largest coeﬃcient of Pˆ . If XY < D2/(3δ) , then in time polynomial in (log D, δ), we can ﬁnd all integer pairs (x0 , y0 ) such that P (x0 , y0 ) = 0, |x0 | < X and |y0 | < Y . Again, the method extends heuristically to more than two variables, and there can be improved bounds depending on the shape10 of the polynomial (see [38]). Theorem 8 was introduced to factor in polynomial time an RSA–modulus11 N = pq provided that half of the (either least or most signiﬁcant) bits of either p or q are known (see [38,17,20]). This was suﬃcient to break an ID-based RSA encryption scheme proposed by Vanstone and Zuccherato [134]. Boneh et al. [20] provide another application, for recovering the RSA secret key when a large fraction of the bits of the secret exponent is known. Curiously, none of the applications cited above happen to be “true” applications of Theorem 8. It was later realized in [71,21] that those results could alternatively be obtained from a (simple) variant of the univariate modular case (Theorem 5).

7

Lattices and RSA

Section 3 and 6 suggest to clarify the links existing between lattice reduction and RSA [120], the most famous public-key cryptosystem. We refer to [95] for an exposition of RSA, and to [16] for a survey of attacks on RSA encryption. Recall that in RSA, one selects two prime numbers p and q of approximately the 9 10

11

However current proofs are somehow more technical than for Theorem 5. A simpliﬁcation analogue to what has been obtained for Theorem 5 would be useful. The coeﬃcient 2/3 is natural from the remarks at the end of the previous section for the bivariate modular case. If we had assumed P to have total degree δ, the bound would be XY < D1δ . p and q are assumed to have similar size.

The Two Faces of Lattices in Cryptology

171

same size. The number N = pq is public. One selects an integer d coprime with φ(N ) = (p − 1)(q − 1). The integer d is the private key, and is called the RSA secret exponent. The public exponent is the inverse e of d modulo φ(N ). 7.1

Lattice Attacks on RSA Encryption

Small Public Exponent. When the public exponent e is very small, such as 3, one can apply Coppersmith’s method (seen in the previous section) for univariate polynomials in various settings (see [16,38,42] for exact statements): – An attacker can recover the plaintext of a given ciphertext, provided a large part of the plaintext is known. – If a message is randomized before encryption, by simply padding random bits at a known place, an attacker can recover the message provided the amount of randomness is small. – H˚ astad [66] attacks can be improved. An attacker can recover a message broadcasted (by RSA encryption and known aﬃne transformation) to sufﬁciently many participants, each holding a diﬀerent modulus N . This precisely happens if one sends a similar message with diﬀerent known headers or time-stamps which are part of the encryption block. None of the attacks recover the secret exponent d: they can only recover the plaintext. The attacks do not work if appropriate padding is used (see current standards and [95]), or if the public exponent is not too small. For instance, the popular choice e = 65537 is not threatened by these attacks. Small Private Exponent. When d ≤ N 0.25 , an old result of Wiener [137] shows that one can easily recover the secret exponent d (and thus the factorization of N ) from the continued fractions algorithm. Boneh and Durfee [19] recently improved the bound to d ≤ N 0.292 , by applying Coppersmith’s technique to bivariate modular polynomials and improving the generic bound. Note that the attack is heuristic (see Section 6), but experiments showed that it works well in practice (no counterexample has ever been found). This bound holds when the RSA primes are balanced: Durfee and Nguyen [46] improved the bound when the primes are unbalanced, using an extension to trivariate modular polynomials. All those attacks on RSA with small private exponent also hold against the RSA signature scheme, since they only use the public key. A related result (using Coppersmith’s technique for either bivariate integer or univariate modular polynomials) is an attack [20] to recover d when a large portion of the bits of d is known (see [16]). 7.2

Lattice Attacks on RSA Signature

The RSA cryptosystem is often used as a digital signature scheme. To prevent various attacks, one must apply a preprocessing scheme to the message, prior to signature. The recommended solution is to use hash functions and appropriate padding (see current standards and [95]). However, several alternative simple

172

Phong Q. Nguyen and Jacques Stern

solutions not involving hashing have been proposed, and sometimes accepted as standards. Today, all such solutions have been broken (see [57]), some of them by lattice reduction techniques (see [104,57]). Those lattice attacks are heuristic but work well in practice. They apply lattice reduction algorithms to ﬁnd small solutions to modular linear systems, which leads to signature forgeries for certain proposed RSA signature schemes. Finding such small solutions is viewed as a closest vector problem for some norm, as seen in Section 3.4. 7.3

Security of RSA–OAEP

Although no eﬃcient method is known to invert the RSA encryption function in general, it is widely accepted that the RSA encryption scheme should not be directly used as such, because it does not satisfy strong security notions (see for instance [22,95] for a simple explanation): a preprocessing function should be applied to the message prior to encryption. The most famous preprocessing scheme for RSA is OAEP proposed by Bellare and Rogaway [11], which is standardized in PKCS. The RSA–OAEP scheme was only recently proved to be strongly secure (semantic security against adaptive chosen-ciphertext attacks), under the assumption that the RSA function is hard to invert and the random oracle model. This was ﬁrst proved by Shoup [128] for the particular case of public exponent 3 using Coppersmith’s theorem on univariate polynomial equations, and later extended to any exponent by Fujisaki et al. [53]. Interestingly, the last part of the proof of [53] relied on lattices (in dimension 2) to ﬁnd a small solution to a linear modular equation (see Section 3.4). Note however that the result could also have been obtained with continued fractions. Boneh [18] recently proposed a simpler version of OAEP for the RSA and Rabin encryption functions. The proof for Rabin is based on Coppersmith’s lattice-based theorem on univariate polynomial equations, while the proof for RSA uses lattices again to ﬁnd small solutions of linear modular equations. It is somewhat surprising that lattices are used both to attack RSA in certain settings, and to prove the security of industrial uses of RSA. 7.4

Factoring and Lattice Reduction

In the general case, the best attack against RSA encryption or signature is integer factorization. Note that to prove (or disprove) the equivalence between integer factorization and breaking RSA encryption remains an important open problem in cryptology (latest results [25] suggest that breaking RSA encryption may actually be easier). We already pointed out that in some special cases, lattice reduction leads to eﬃcient factorization: when the factors are partially known [38], or when the number to factor has the form pr q with large r [21]. Schnorr [123] was the ﬁrst to establish a link between integer factorization and lattice reduction, which was later extended by Adleman [2]. Schnorr [123] proposed a heuristic method to factor general numbers, using lattice reduction to approximate the closest vector problem in the inﬁnity or the L1 norm. Adleman [2] showed how to use the Euclidean norm instead, which is more suited to current lattice reduction algorithms. Those methods use the same underlying

The Two Faces of Lattices in Cryptology

173

ideas as sieving algorithms (see [36]): to factor a number n, they try to ﬁnd many congruences of smooth numbers to produce random square congruences of the form x2 ≡ y 2 (mod n), after a linear algebra step. Heuristic assumptions are needed to ensure the existence of appropriate congruences. The problem of ﬁnding such congruences is seen as a closest vector problem. Still, it should be noted that those methods are theoretical, since they are not adapted to currently known lattice reduction algorithms. To be useful, they would require very good lattice reduction for lattices of dimension over at least several thousands. We close this review by mentioning that current versions of the Number Field Sieve (NFS) (see [87,36]), the best algorithm known for factoring large integers, use lattice reduction. Indeed, LLL plays a crucial role in the last stage of NFS where one has to compute an algebraic square root of a huge algebraic number given as a product of hundreds of thousands of small ones. The best algorithm known to solve this problem is due to Montgomery (see [105,107]). It has been used in all recent large factorizations, notably the record factorization [34] of a 512-bit RSA-number of 155 decimal digits proposed in the RSA challenges. There, LLL is applied many times in low dimension (less than 10) to ﬁnd nice algebraic integers in integral ideals. But the overall running time of NFS is dominated by other stages, such as sieving and linear algebra.

8

Conclusions

The LLL algorithm and other lattice basis reduction algorithms have proved invaluable in cryptology. They have become the most popular tool in public-key cryptanalysis. In particular, they play a crucial rˆ ole in several attacks against the RSA cryptosystem. The past few years have seen new, sometimes provable, lattice-based methods for solving problems which were a priori not linear, and this deﬁnitely opens new ﬁelds of applications. Interestingly, several provable lattice-based results introduced in cryptanalysis have also recently been used in the area of security proofs. Paradoxically, at the same time, a series of complexity results on lattice reduction has emerged, giving rise to another family of cryptographic schemes based on the hardness of lattice problems. The resulting cryptosystems have enjoyed diﬀerent fates, but it is probably too early to tell whether or not secure and practical cryptography can be built using hardness of lattice problems. Indeed, several questions on lattices remain open. In particular, we still do not know whether or not it is easy to approximate the shortest vector problem up to some polynomial factor, or to ﬁnd the shortest vector when the lattice gap is larger than some polynomial in the dimension. Besides, only very few lattice basis reduction algorithms are known, and their behaviour (both complexity and output quality) is still not well understood. And so far, there has not been any massive computer experiment in lattice reduction comparable to what has been done for integer factorization or the elliptic curve discrete logarithm problem. Twenty years of lattice reduction yielded surprising applications in cryptology. We hope the next twenty years will prove as exciting.

174

Phong Q. Nguyen and Jacques Stern

Acknowledgements We thank Dan Boneh, Don Coppersmith, Glenn Durfee, Arjen and Hendrik Lenstra, L´ aszl´o Lov´asz, Daniele Micciancio, Igor Shparlinski and Joe Silverman for helpful discussions and comments.

References 1. L. M. Adleman. On breaking generalized knapsack publick key cryptosystems. In Proc. of 15th STOC, pages 402–412. ACM, 1983. 2. L. M. Adleman. Factoring and lattice reduction. Unpublished manuscript, 1995. 3. M. Ajtai. Generating hard instances of lattice problems. In Proc. of 28th STOC, pages 99–108. ACM, 1996. Available at [47] as TR96-007. 4. M. Ajtai. The shortest vector problem in L2 is NP-hard for randomized reductions. In Proc. of 30th STOC. ACM, 1998. Available at [47] as TR97-047. 5. M. Ajtai and C. Dwork. A public-key cryptosystem with worst-case/average-case equivalence. In Proc. of 29th STOC, pages 284–293. ACM, 1997. Available at [47] as TR96-065. 6. M. Ajtai, R. Kumar, and D. Sivakumar. A sieve algorithm for the shortest lattice vector problem. In Proc. 33rd STOC, pages 601–610. ACM, 2001. 7. S. Arora, L. Babai, J. Stern, and Z. Sweedyk. The hardness of approximate optima in lattices, codes, and systems of linear equations. Journal of Computer and System Sciences, 54(2):317–331, 1997. 8. L. Babai. On Lov´ asz lattice reduction and the nearest lattice point problem. Combinatorica, 6:1–13, 1986. 9. W. Banaszczyk. New bounds in some transference theorems in the geometry of numbers. Mathematische Annalen, 296:625–635, 1993. 10. M. Bellare, S. Goldwasser, and D. Micciancio. ”Pseudo-random” number generation within cryptographic algorithms: The DSS case. In Proc. of Crypto’97, volume 1294 of LNCS. IACR, Springer-Verlag, 1997. 11. M. Bellare and P. Rogaway. Optimal asymmetric encryption. In Proc. of Eurocrypt’94, volume 950 of LNCS, pages 92–111. IACR, Springer-Verlag, 1995. 12. D. Bleichenbacher. On the security of the KMOV public key cryptosystem. In Proc. of Crypto’97, volume 1294 of LNCS, pages 235–248. IACR, Springer-Verlag, 1997. 13. D. Bleichenbacher and P. Q. Nguyen. Noisy polynomial interpolation and noisy Chinese remaindering. In Proc. of Eurocrypt ’00, volume 1807 of LNCS. IACR, Springer-Verlag, 2000. 14. J. Bl¨ omer and J.-P. Seifert. On the complexity of computing short linearly independent vectors and short bases in a lattice. In Proc. of 31st STOC. ACM, 1999. 15. D. Boneh. The decision Diﬃe-Hellman problem. In Algorithmic Number Theory – Proc. of ANTS-III, volume 1423 of LNCS. Springer-Verlag, 1998. 16. D. Boneh. Twenty years of attacks on the RSA cryptosystem. Notices of the AMS, 46(2):203–213, 1999. 17. D. Boneh. Finding smooth integers in short intervals using CRT decoding. In Proc. of 32nd STOC. ACM, 2000. 18. D. Boneh. Simpliﬁed OAEP for the RSA and Rabin functions. In Proc. of Crypto 2001, LNCS. IACR, Springer-Verlag, 2001. 19. D. Boneh and G. Durfee. Cryptanalysis of RSA with private key d less than N 0.292 . In Proc. of Eurocrypt’99, volume 1592 of LNCS, pages 1–11. IACR, Springer-Verlag, 1999.

The Two Faces of Lattices in Cryptology

175

20. D. Boneh, G. Durfee, and Y. Frankel. An attack on RSA given a small fraction of the private key bits. In Proc. of Asiacrypt’98, volume 1514 of LNCS, pages 25–34. Springer-Verlag, 1998. 21. D. Boneh, G. Durfee, and N. A. Howgrave-Graham. Factoring n = pr q for large r. In Proc. of Crypto’99, volume 1666 of LNCS. IACR, Springer-Verlag, 1999. 22. D. Boneh, A. Joux, and P. Q. Nguyen. Why textbook ElGamal and RSA encryption are insecure. In Proc. of Asiacrypt ’00, volume 1976 of LNCS. IACR, Springer-Verlag, 2000. 23. D. Boneh and I. E. Shparlinski. Hard core bits for the elliptic curve Diﬃe-Hellman secret. In Proc. of Crypto 2001, LNCS. IACR, Springer-Verlag, 2001. 24. D. Boneh and R. Venkatesan. Hardness of computing the most signiﬁcant bits of secret keys in Diﬃe-Hellman and related schemes. In Proc. of Crypto’96, LNCS. IACR, Springer-Verlag, 1996. 25. D. Boneh and R. Venkatesan. Breaking RSA may not be equivalent to factoring. In Proc. of Eurocrypt’98, volume 1233 of LNCS, pages 59–71. Springer-Verlag, 1998. 26. V. Boyko, M. Peinado, and R. Venkatesan. Speeding up discrete log and factoring based schemes via precomputations. In Proc. of Eurocrypt’98, volume 1403 of LNCS, pages 221–235. IACR, Springer-Verlag, 1998. 27. E. F. Brickell. Solving low density knapsacks. In Proc. of Crypto ’83. Plenum Press, 1984. 28. E. F. Brickell. Breaking iterated knapsacks. In Proc. of Crypto ’84, volume 196 of LNCS. Springer-Verlag, 1985. 29. E. F. Brickell and A. M. Odlyzko. Cryptanalysis: A survey of recent results. In G. J. Simmons, editor, Contemporary Cryptology, pages 501–540. IEEE Press, 1991. 30. J.-Y. Cai. Some recent progress on the complexity of lattice problems. In Proc. of FCRC, 1999. Available at [47] as TR99-006. 31. J.-Y. Cai. The complexity of some lattice problems. In Proc. of ANTS-IV, volume 1838 of LNCS. Springer-Verlag, 2000. 32. J.-Y. Cai and T. W. Cusick. A lattice-based public-key cryptosystem. Information and Computation, 151:17–31, 1999. 33. J.-Y. Cai and A. P. Nerurkar. An improved worst-case to average-case connection for lattice problems. In Proc. of 38th FOCS, pages 468–477. IEEE, 1997. 34. S. Cavallar, B. Dodson, A. K. Lenstra, W. Lioen, P. L. Montgomery, B. Murphy, H. te Riele, K. Aardal, J. Gilchrist, G. Guillerm, P. Leyland, J. Marchand, F. Morain, A. Muﬀett, C. Putnam, and P. Zimmermann. Factorization of 512-bit RSA key using the number ﬁeld sieve. In Proc. of Eurocrypt ’00, volume 1807 of LNCS. IACR, Springer-Verlag, 2000. 35. B. Chor and R.L. Rivest. A knapsack-type public key cryptosystem based on arithmetic in ﬁnite ﬁelds. IEEE Trans. Inform. Theory, 34, 1988. 36. H. Cohen. A Course in Computational Algebraic Number Theory. Springer-Verlag, 1995. Second edition. 37. J.H. Conway and N.J.A. Sloane. Sphere Packings, Lattices and Groups. SpringerVerlag, 1998. Third edition. 38. D. Coppersmith. Small solutions to polynomial equations, and low exponent RSA vulnerabilities. J. of Cryptology, 10(4):233–260, 1997. Revised version of two articles from Eurocrypt’96. 39. D. Coppersmith. Finding small solutions to small degree polynomials. In Proc. of CALC 2001, LNCS. Springer-Verlag, 2001. 40. D. Coppersmith and A. Shamir. Lattice attacks on NTRU. In Proc. of Eurocrypt’97, LNCS. IACR, Springer-Verlag, 1997.

176

Phong Q. Nguyen and Jacques Stern

41. M.J. Coster, A. Joux, B.A. LaMacchia, A.M. Odlyzko, C.-P. Schnorr, and J. Stern. Improved low-density subset sum algorithms. Comput. Complexity, 2:111–128, 1992. 42. C. Coup´e, P. Q. Nguyen, and J. Stern. The eﬀectiveness of lattice attacks against low-exponent RSA. In Proc. of PKC’98, volume 1431 of LNCS. Springer-Verlag, 1999. 43. W. Diﬃe and M. E. Hellman. New directions in cryptography. IEEE Trans. Inform. Theory, IT-22:644–654, Nov 1976. 44. I. Dinur. Approximating SVP∞ to within almost-polynomial factors is NP-hard. Available at [47] as TR99-016. 45. I. Dinur, G. Kindler, and S. Safra. Approximating CVP to within almostpolynomial factors is NP-hard. In Proc. of 39th FOCS, pages 99–109. IEEE, 1998. Available at [47] as TR98-048. 46. G. Durfee and P. Q. Nguyen. Cryptanalysis of the RSA schemes with short secret exponent from Asiacrypt’99. In Proc. of Asiacrypt ’00, volume 1976 of LNCS. IACR, Springer-Verlag, 2000. 47. ECCC. http://www.eccc.uni-trier.de/eccc/. The Electronic Colloquium on Computational Complexity. 48. E. El Mahassni, P. Q. Nguyen, and I. E. Shparlinski. The insecurity of Nyberg– Rueppel and other DSA-like signature schemes with partially known nonces. In Proc. of CALC 2001, LNCS. Springer-Verlag, 2001. 49. P. van Emde Boas. Another NP-complete problem and the complexity of computing short vectors in a lattice. Technical report, Mathematische Instituut, University of Amsterdam, 1981. Report 81-04. Available at http://turing.wins.uva.nl/~peter/. 50. R. Fischlin and J.-P. Seifert. Tensor-based trapdoors for CVP and their application to public key cryptography. In IMA Conference on Cryptography and Coding, LNCS. Springer-Verlag, 1999. 51. A. M. Frieze. On the Lagarias-Odlyzko algorithm for the subset sum problem. SIAM J. Comput, 15(2):536–539, 1986. 52. A. M. Frieze, J. H˚ astad, R. Kannan, J. C. Lagarias, and A. Shamir. Reconstructing truncated integer variables satisfying linear congruences. SIAM J. Comput., 17(2):262–280, 1988. Special issue on cryptography. 53. E. Fujisaki, T. Okamoto, D. Pointcheval, and J. Stern. RSA–OAEP is secure under the RSA assumption. In Proc. of Crypto 2001, LNCS. IACR, SpringerVerlag, 2001. 54. M. L. Furst and R. Kannan. Succinct certiﬁcates for almost all subset sum problems. SIAM J. Comput, 18(3):550–558, 1989. 55. C.F. Gauss. Disquisitiones Arithmeticæ. Leipzig, 1801. 56. C. Gentry. Key recovery and message attacks on NTRU-composite. In Proc. of Eurocrypt 2001, volume 2045 of LNCS. IACR, Springer-Verlag, 2001. 57. M. Girault and J.-F. Misarsky. Cryptanalysis of countermeasures proposed for repairing ISO 9796–1. In Proc. of Eurocrypt ’00, volume 1807 of LNCS. IACR, Springer-Verlag, 2000. 58. O. Goldreich and S. Goldwasser. On the limits of non-approximability of lattice problems. In Proc. of 30th STOC. ACM, 1998. Available at [47] as TR97-031. 59. O. Goldreich, S. Goldwasser, and S. Halevi. Challenges for the GGH cryptosystem. Available at http://theory.lcs.mit.edu/ shaih/challenge.html. 60. O. Goldreich, S. Goldwasser, and S. Halevi. Eliminating decryption errors in the Ajtai-Dwork cryptosystem. In Proc. of Crypto’97, volume 1294 of LNCS, pages 105–111. IACR, Springer-Verlag, 1997. Available at [47] as TR97-018. 61. O. Goldreich, S. Goldwasser, and S. Halevi. Public-key cryptosystems from lattice reduction problems. In Proc. of Crypto’97, volume 1294 of LNCS, pages 112–131. IACR, Springer-Verlag, 1997. Available at [47] as TR96-056.

The Two Faces of Lattices in Cryptology

177

62. O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors, 1999. Available at [47] as TR99-002. 63. M. I. Gonz´ alez Vasco and I. E. Shparlinski. On the security of Diﬃe-Hellman bits. In K.-Y. Lam, I. E. Shparlinski, H. Wang, and C. Xing, editors, Proc. Workshop on Cryptography and Comp. Number Theory (CCNT’99). Birkhauser, 2000. 64. M. Gr¨ otschel, L. Lov´ asz, and A. Schrijver. Geometric Algorithms and Combinatorial Optimization. Springer-Verlag, 1993. 65. M. Gruber and C. G. Lekkerkerker. Geometry of Numbers. North-Holland, 1987. 66. J. H˚ astad. Solving simultaneous modular equations of low degree. SIAM J. Comput., 17(2):336–341, April 1988. Preliminary version in Proc. of Crypto ’85. 67. B. Helfrich. Algorithms to construct Minkowski reduced and Hermite reduced bases. Theoretical Computer Science, 41:125–139, 1985. 68. C. Hermite. Extraits de lettres de M. Hermite a ` M. Jacobi sur diﬀ´erents objets de la th´eorie des nombres, deuxi`eme lettre. J. Reine Angew. Math., 40:279–290, 1850. Also available in the ﬁrst volume of Hermite’s complete works, published by Gauthier-Villars. 69. J. Hoﬀstein, J. Pipher, and J.H. Silverman. NTRU: a ring based public key cryptosystem. In Proc. of ANTS III, volume 1423 of LNCS, pages 267–288. Springer-Verlag, 1998. Additional information at http://www.ntru.com. 70. N. A. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding, volume 1355 of LNCS, pages 131–142. Springer-Verlag, 1997. 71. N. A. Howgrave-Graham. Computational Mathematics Inspired by RSA. PhD thesis, University of Bath, 1998. 72. N. A. Howgrave-Graham. Approximate integer common divisors. In Proc. of CALC 2001, LNCS. Springer-Verlag, 2001. 73. N. A. Howgrave-Graham and N. P. Smart. Lattice attacks on digital signature schemes. Technical report, HP Labs, 1999. HPL-1999-90. To appear in Designs, Codes and Cryptography. 74. E. Jaulmes and A. Joux. A chosen ciphertext attack on NTRU. In Proc. of Crypto 2000, volume 1880 of LNCS. IACR, Springer-Verlag, 2000. 75. A. Joux and J. Stern. Lattice reduction: A toolbox for the cryptanalyst. J. of Cryptology, 11:161–185, 1998. 76. C. S. Jutla. On ﬁnding small solutions of modular multivariate polynomial equations. In Proc. of Eurocrypt’98, volume 1403 of LNCS, pages 158–170. IACR, Springer-Verlag, 1998. 77. R. Kannan. Improved algorithms for integer programming and related lattice problems. In Proc. of 15th STOC, pages 193–206. ACM, 1983. 78. R. Kannan. Algorithmic geometry of numbers. Annual review of computer science, 2:231–267, 1987. 79. R. Kannan. Minkowski’s convex body theorem and integer programming. Math. Oper. Res., 12(3):415–440, 1987. 80. P. Klein. Finding the closest lattice vector when it’s unusually close. In Proc. of SODA ’00. ACM–SIAM, 2000. 81. S. V. Konyagin and T. Seger. On polynomial congruences. Mathematical Notes, 55(6):596–600, 1994. 82. A. Korkine and G. Zolotareﬀ. Sur les formes quadratiques positives ternaires. Math. Ann., 5:581–583, 1872. 83. A. Korkine and G. Zolotareﬀ. Sur les formes quadratiques. Math. Ann., 6:336– 389, 1873. 84. J. C. Lagarias. Point lattices. In R. Graham, M. Gr¨ otschel, and L. Lov´ asz, editors, Handbook of Combinatorics, volume 1, chapter 19. Elsevier, 1995.

178

Phong Q. Nguyen and Jacques Stern

85. J. C. Lagarias and A. M. Odlyzko. Solving low-density subset sum problems. Journal of the Association for Computing Machinery, January 1985. 86. L. Lagrange. Recherches d’arithm´etique. Nouv. M´em. Acad., 1773. 87. A. K. Lenstra and H. W. Lenstra, Jr. The Development of the Number Field Sieve, volume 1554 of Lecture Notes in Mathematics. Springer-Verlag, 1993. 88. A. K. Lenstra, H. W. Lenstra, Jr., and L. Lov´ asz. Factoring polynomials with rational coeﬃcients. Mathematische Ann., 261:513–534, 1982. 89. H. W. Lenstra, Jr. Integer programming with a ﬁxed number of variables. Technical report, Mathematisch Instituut, Universiteit van Amsterdam, April 1981. Report 81-03. 90. H. W. Lenstra, Jr. Integer programming with a ﬁxed number of variables. Math. Oper. Res., 8(4):538–548, 1983. 91. L. Lov´ asz. An Algorithmic Theory of Numbers, Graphs and Convexity, volume 50. SIAM Publications, 1986. CBMS-NSF Regional Conference Series in Applied Mathematics. ´ 92. J. Martinet. Les R´eseaux Parfaits des Espaces Euclidiens. Editions Masson, 1996. English translation to appear at Springer-Verlag. 93. J. E. Mazo and A. M. Odlyzko. Lattice points in high-dimensional spheres. Monatsh. Math., 110:47–61, 1990. 94. R.J. McEliece. A public-key cryptosystem based on algebraic number theory. Technical report, Jet Propulsion Laboratory, 1978. DSN Progress Report 42-44. 95. A. Menezes, P. Van Oorschot, and S. Vanstone. Handbook of Applied Cryptography. CRC Press, 1997. 96. R. Merkle and M. Hellman. Hiding information and signatures in trapdoor knapsacks. IEEE Trans. Inform. Theory, IT-24:525–530, September 1978. 97. D. Micciancio. On the Hardness of the Shortest Vector Problem. PhD thesis, Massachusetts Institute of Technology, 1998. 98. D. Micciancio. The shortest vector problem is NP-hard to approximate within some constant. In Proc. of 39th FOCS. IEEE, 1998. Available at [47] as TR98-016. 99. D. Micciancio. Lattice based cryptography: A global improvement. Technical report, Theory of Cryptography Library, 1999. Report 99-05. 100. D. Micciancio. The hardness of the closest vector problem with preprocessing. IEEE Trans. Inform. Theory, 47(3):1212–1215, 2001. 101. D. Micciancio. Improving lattice-based cryptosystems using the Hermite normal form. In Proc. of CALC 2001, LNCS. Springer-Verlag, 2001. 102. J. Milnor and D. Husemoller. Symmetric Bilinear Forms. Springer-Verlag, 1973. 103. H. Minkowski. Geometrie der Zahlen. Teubner-Verlag, Leipzig, 1896. 104. J.-F. Misarsky. A multiplicative attack using LLL algorithm on RSA signatures with redundancy. In Proc. of Crypto’97, volume 1294 of LNCS, pages 221–234. IACR, Springer-Verlag, 1997. 105. P. L. Montgomery. Square roots of products of algebraic numbers. In Walter Gautschi, editor, Mathematics of Computation 1943-1993: a Half-Century of Computational Mathematics, Proc. of Symposia in Applied Mathematics, pages 567–571. American Mathematical Society, 1994. 106. National Institute of Standards and Technology (NIST). FIPS Publication 186: Digital Signature Standard, May 1994. 107. P. Q. Nguyen. A Montgomery-like square root for the number ﬁeld sieve. In Algorithmic Number Theory – Proc. of ANTS-III, volume 1423 of LNCS. SpringerVerlag, 1998. 108. P. Q. Nguyen. Cryptanalysis of the Goldreich-Goldwasser-Halevi cryptosystem from Crypto’97. In Proc. of Crypto’99, volume 1666 of LNCS, pages 288–304. IACR, Springer-Verlag, 1999.

The Two Faces of Lattices in Cryptology

179

109. P. Q. Nguyen. La G´eom´etrie des Nombres en Cryptologie. PhD thesis, Universit´e Paris 7, November 1999. Available at http://www.di.ens.fr/~pnguyen/. 110. P. Q. Nguyen. The dark side of the hidden number problem: Lattice attacks on DSA. In K.-Y. Lam, I. E. Shparlinski, H. Wang, and C. Xing, editors, Proc. Workshop on Cryptography and Comp. Number Theory (CCNT’99). Birkhauser, 2000. 111. P. Q. Nguyen and I. E. Shparlinski. The insecurity of the Digital Signature Algorithm with partially known nonces. J. of Cryptology, 2001. To appear. 112. P. Q. Nguyen and I. E. Shparlinski. The insecurity of the elliptic curve Digital Signature Algorithm with partially known nonces. Preprint, 2001. 113. P. Q. Nguyen and J. Stern. Merkle-Hellman revisited: a cryptanalysis of the Qu-Vanstone cryptosystem based on group factorizations. In Proc. of Crypto’97, volume 1294 of LNCS, pages 198–212. IACR, Springer-Verlag, 1997. 114. P. Q. Nguyen and J. Stern. Cryptanalysis of a fast public key cryptosystem presented at SAC ’97. In Selected Areas in Cryptography – Proc. of SAC’98, volume 1556 of LNCS. Springer-Verlag, 1998. 115. P. Q. Nguyen and J. Stern. Cryptanalysis of the Ajtai-Dwork cryptosystem. In Proc. of Crypto’98, volume 1462 of LNCS, pages 223–242. IACR, Springer-Verlag, 1998. 116. P. Q. Nguyen and J. Stern. The B´eguin-Quisquater server-aided RSA protocol from Crypto ’95 is not secure. In Proc. of Asiacrypt’98, volume 1514 of LNCS, pages 372–379. Springer-Verlag, 1998. 117. P. Q. Nguyen and J. Stern. The hardness of the hidden subset sum problem and its cryptographic implications. In Proc. of Crypto’99, volume 1666 of LNCS, pages 31–46. IACR, Springer-Verlag, 1999. 118. P. Q. Nguyen and J. Stern. Lattice reduction in cryptology: An update. In Proc. of ANTS-IV, volume 1838 of LNCS. Springer-Verlag, 2000. 119. A. M. Odlyzko. The rise and fall of knapsack cryptosystems. In Cryptology and Computational Number Theory, volume 42 of Proc. of Symposia in Applied Mathematics, pages 75–88. A.M.S., 1990. 120. R. L. Rivest, A. Shamir, and L. M. Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2):120–126, 1978. 121. C. P. Schnorr. A hierarchy of polynomial lattice basis reduction algorithms. Theoretical Computer Science, 53:201–224, 1987. 122. C. P. Schnorr. A more eﬃcient algorithm for lattice basis reduction. J. of algorithms, 9(1):47–62, 1988. 123. C. P. Schnorr. Factoring integers and computing discrete logarithms via diophantine approximation. In Proc. of Eurocrypt’91, volume 547 of LNCS, pages 171–181. IACR, Springer-Verlag, 1991. 124. C. P. Schnorr and M. Euchner. Lattice basis reduction: improved practical algorithms and solving subset sum problems. Math. Programming, 66:181–199, 1994. 125. C. P. Schnorr and H. H. H¨ orner. Attacking the Chor-Rivest cryptosystem by improved lattice reduction. In Proc. of Eurocrypt’95, volume 921 of LNCS, pages 1–12. IACR, Springer-Verlag, 1995. 126. A. Shamir. A polynomial time algorithm for breaking the basic Merkle-Hellman cryptosystem. In Proc. of 23rd FOCS, pages 145–152. IEEE, 1982. 127. V. Shoup. Number Theory C++ Library (NTL) version 3.6. Available at http://www.shoup.net/ntl/. 128. V. Shoup. OAEP reconsidered. In Proc. of Crypto 2001, LNCS. IACR, SpringerVerlag, 2001. 129. I. E. Shparlinski. On the generalized hidden number problem and bit security of XTR. In Proc. of 14th Symp. on Appl. Algebra, Algebraic Algorithms, and Error-Correcting Codes, LNCS. Springer-Verlag, 2001.

180

Phong Q. Nguyen and Jacques Stern

130. I. E. Shparlinski. Sparse polynomial approximation in ﬁnite ﬁelds. In Proc. 33rd STOC. ACM, 2001. 131. C. L. Siegel. Lectures on the Geometry of Numbers. Springer-Verlag, 1989. 132. B. Vall´ee. La r´eduction des r´eseaux. autour de l’algorithme de Lenstra, Lenstra, Lov´ asz. RAIRO Inform. Th´ eor. Appl, 23(3):345–376, 1989. 133. B. Vall´ee, M. Girault, and P. Toﬃn. How to guess -th roots modulo n by reducing lattice bases. In Proc. of AAEEC-6, volume 357 of LNCS, pages 427–442. Springer-Verlag, 1988. 134. S. A. Vanstone and R. J. Zuccherato. Short RSA keys and their generation. J. of Cryptology, 8(2):101–114, 1995. 135. S. Vaudenay. Cryptanalysis of the Chor-Rivest cryptosystem. In Proc. of Crypto’98, volume 1462 of LNCS. IACR, Springer-Verlag, 1998. 136. E. R. Verheul. Certiﬁcates of recoverability with scalable recovery agent security. In Proc. of PKC’00, LNCS. Springer-Verlag, 2000. 137. M. Wiener. Cryptanalysis of short RSA secret exponents. IEEE Trans. Inform. Theory, 36(3):553–558, 1990.

A 3-Dimensional Lattice Reduction Algorithm Igor Semaev Moscow State University Laboratory of Mathematical Problems of Cryptology Vorobievy gori, 119899, Moscow, Russia [email protected]

Abstract. The aim of this paper is a reduction algorithm for a basis b1 , b2 , b3 of a 3-dimensional lattice in Rn for ﬁxed n ≥ 3. We give a deﬁnition of the reduced basis which is equivalent to that of the Minkowski reduced basis of a 3-dimensional lattice. We prove that for b1 , b2 , b3 ∈ Zn , n ≥ 3 and |b1 |, |b2 |, |b3 | ≤ M , our algorithm takes O(log2 M ) binary operations, without using fast integer arithmetic, to reduce this basis and so to ﬁnd the shortest vector in the lattice. The deﬁnition and the algorithm can be extended to any dimension. Elementary steps of our algorithm are rather diﬀerent from those of the LLL-algorithm, which works in O(log 3 M ) binary operations without using fast integer arithmetic. Keywords: 3-dimensional lattice, lattice reduction problem, shortest vector in a lattice, Gaussian algorithm, LLL-algorithm.

1

Introduction. The Gaussian Reduction Algorithm

Let Rn be n-dimensional space over the ﬁeld R of real numbers. Let b1 , b2 , . . . , bk , k ≤ n, be linearly independent vectors in Rn . A lattice of dimension k in Rn is the set of vectors L = {z1 b1 + z2 b2 + · · · + zk bk |zi ∈ Z}. The determinant of L is deﬁned by ∆(L) = | det BB |1/2 , where B is the k × n matrix whose rows are b1 , b2 , . . . , bk . For k = n we have ∆(L) = | det B|. Let |b| be the Euclidean length of the vector b ∈ Rn . By λ(L) we denote the length of a shortest nonzero vector in L. Finding the shortest vector of a lattice given by some basis is a diﬃcult problem in high dimension. There exists the famous LLL-algorithm [4] for ﬁnding a nonzero b ∈ L such that |b| ≤ 2(k−1)/2 λ(L). For L ⊆ Zn (n is ﬁxed) and |b1 |, |b2 |, . . . , |bk | ≤ M , the LLL-algorithm works in O(log3 M ) binary operations without using fast integer arithmetic. This algorithm performs the following operations: 1. exchanging vectors bi and bj for i, j such that 1 ≤ i, j ≤ k; 2. replacement of some vector bj by bj − rbi for i, j such that 1 ≤ i, j ≤ k and an integer r. J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 181–193, 2001. c Springer-Verlag Berlin Heidelberg 2001

182

Igor Semaev

For k = 2 we have the Gaussian reduction algorithm [2]. We say that a pair a, b ∈ Rn , n ≥ 2, is reduced if |a| ≤ |b|

and

2|(a, b)| ≤ |a|2 .

Let b1 , b2 be a basis of some 2-dimensional lattice L, where |b2 | ≤ |b1 |. We compute r = (b1 , b2 )/|b2 |2 and set a = b1 − rb2 . (Here x denotes the closest integer to x.) If |a| ≥ |b2 |, then b2 is the shortest vector in L and the algorithm terminates. If |a| < |b2 |, then we set b3 = a and apply the above step to the pair b2 , b3 , and so on. Thus we get a reduced pair bs , a = G(b1 , b2 ), where bs is the shortest vector in L. Let b1 , b2 ∈ Zn , n ≥ 2 and |b2 | ≤ |b1 | ≤ M . We suppose the basis is deﬁned also by integers |b1 |2 ,|b2 |2 , and (b1 , b2 ). Let us prove that Gaussian reduction takes O

1| 1 + log |b |bs | log |b1 |

binary operations for ﬁxed n, where bs is the

shortest vector of the lattice spanned by b1 and b2 . So it takes O(log2 M ) operations. Consider the ﬁrst step of the Gaussian algorithm. To accomplish this step one needs to divide (b1 , b2 ) by |b2 |2 with remainder. From the Cauchy-Schwarz inequality it follows |(b1 , b2 )|/|b2 |2 ≤ |b1 |/|b2 |. Then for r = (b1 , b2 )/|b2 |2 we have to compute |b3 |2 and (b3 , b2 ) by the formulas |b3 |2 = |b1 |2 − 2r(b1 , b2 ) + r2 |b2 |2 and (b3 , b2 ) = (b1 , b2 ) − r|b2 |2 . 1| This takes O 1 + log |b |b2 | log |b1 | binary operations. Generally, the algorithm takes s |b1 | |bi−1 | s + log O 1 + log log |bi−1 | = O log |b1 | |bi | |bs | i=2 binary operations, where s − 1 is the number of steps. Let us show that s = |b1 | O 1 + log |bs | .

Let b1 , b2 be a nonreduced pair, where |b2 | ≤ |b1 |. Consider the ﬁrst step of the algorithm. It is easy to prove that if |(b1 , b2 )| ≥ |b2 |2 , then |b1 |2 ≥ |b3 |2 +|b2 |2 ; and if |(b1 , b2 )| < |b2 |2 , then the pair b2 , b3 is reduced. So if b2 , b3 is not reduced, 1| 2 2 then |b1 | ≥ 2|b3 | and so on. Therefore s = O 1 + log |b |bs | . The aim of this paper is a reduction algorithm for a basis b1 , b2 , b3 of a 3dimensional lattice in Rn , n ≥ 3. We give a deﬁnition of reduced basis and prove that for b1 , b2 , b3 ∈ Zn , n ≥ 3 and |b1 |, |b2 |, |b3 | ≤ M , our algorithm takes O(log2 M ) binary operations, without fast arithmetic, to reduce this basis and so to ﬁnd the shortest vector in the lattice. The deﬁnition and the algorithm can be extended to any dimension. Elementary steps of our algorithm are rather diﬀerent from those of the LLL-algorithm. This paper contains four sections besides the introduction. In the second section, we derive some reduction algorithms based only on Gaussian pairwise

A 3-Dimensional Lattice Reduction Algorithm

183

reduction. Examples show that this algorithm can take O(log3 M ) binary operations and not give the shortest vector in some cases. In the third section, we give the deﬁnition of reduced basis which is equivalent to that of the Minkowski reduced basis for a 3-dimensional lattice. We give here a reduction algorithm, but it is still slow. In the fourth section we derive another reduction algorithm, and in the ﬁfth section we ﬁnish the proof that it takes O(log2 M ) binary operations. There is an algorithm for lattice reduction in dimension 3 due to Vallee [5]. It is geometric and deals with integer lattices in R3 . While this algorithm is based essentially on the same ideas as ours, its complexity is bounded by O(µ(M ) log M ) binary operations, as follows from Theorem 2 of [5], so O(log3 M ) binary operations without using fast arithmetic. Here µ(M ) is the cost of a multiplication performed on two integers of absolute value less than M Our algorithm can be slightly modiﬁed to reduce positive deﬁnite ternary quadratic forms in the same time. Recently a new algorithm for reducing such forms was derived by Eisenbrand [3]. It uses Gauss-Lagarias ideas and takes O(µ(M ) log log M ) binary operations, so O((log M )2 log log M ) binary operations without using fast arithmetic. With fast integer multiplication algorithms it may be faster than ours. But I think our algorithm is more practical for reasonable inputs and it is easy to implement. Thanks to an anonymous referee for pointing to Vallee’s paper [5], to Eisenbrand for sharing his paper [3] with me, and to the conference organizers for arranging for my paper to be retyped in TEX.

2

The Naive Approach

We ﬁrst prove two useful lemmas. Lemma 1. Let b1 , b2 be linearly independent vectors in Rn , n ≥ 2, such that |b1 | ≤ |b2 |. Then the inequality 2|(b1 , b2 )| ≤ |b1 |2 is equivalent to the inequality |b2 + xb1 | ≥ |b2 | for all integers x. Proof. The proof of this lemma is obvious. We denote by ij the sign of the scalar product (bi , bj ). Thus ij = sgn(bi , bj ), where   if α > 0, 1 sgn(α) = −1 if α < 0,   0 if α = 0. Lemma 2. Let b1 , b2 be linearly independent vectors in Rn , n ≥ 2. If 12 = 0, then the pair b1 , b2 is reduced; otherwise it is reduced if and only if |b2 − 12 b1 | ≥ max{|b1 |, |b2 |}.

(1)

184

Igor Semaev

Proof. We need prove it only for 12 = −1; that is, we need to prove the inequality |b2 + b1 | ≥ max{|b1 |, |b2 |}. (2) Let |b1 | ≤ |b2 |. Then 2|(b1 , b2 )| ≤ |b1 |2 is equivalent to 0 ≤ |b1 |2 − 2|(b1 , b2 )| = |b2 + b1 |2 − |b2 |2 , which is equivalent to (2). Thus the statement is proved. Definition 1. We say that a basis b1 , b2 , b3 of a 3-dimensional lattice L in Rn , n ≥ 3, is 2-reduced if its vectors are pairwise reduced. Algorithm 1 (Algorithm for 2-Reducing). Input: A basis b1 , b2 , b3 of a 3-dimensional lattice in Rn , n ≥ 3. Output: A 2-reduced basis b1 , b2 , b3 of this lattice. Step 1. (find a nonreduced pair) If bi , bj is not reduced for some i, j ∈ {1, 2, 3}, then to to Step 2, else terminate. Step 2. (reduce the pair) Evaluate a, b = G(bi , bj ), replace bi , bj ← a, b, and go to Step 1. Remark 1. We note that to evaluate the shortest vector, it is not enough to apply only the Gaussian pairwise reduction algorithm. Consider the basis: √ √ 1 1 3 3 b2 = , ,0 , b3 = ,− ,δ , b1 = (1, 0, 0), 2 2 2 2 where δ = 0. It is easy to see that |b1 |2 = |b2 |2 = 1, (b1 , b2 ) = (b1 , b3 ) =

|b3 |2 = 1 + δ 2 , 1 , 2

1 (b2 , b3 ) = − . 2

Thus the basis is 2-reduced. But a = b3 − b1 + b2 = (0, 0, δ) and |a| < |b1 |, |b2 |, |b3 | for δ < 1. Remark 2. Algorithm 1 can take O(log3 M ) binary operations to ﬁnd a 2-reduced basis for b1 , b2 , b3 ∈ Zn , n ≥ 3, where |b1 |, |b2 |, |b3 | ≤ M . This is true for the following basis: b1 = (1, 1, 0),

b2 = (N, 0, 0),

where M and N are integers satisfying N 2 < M .

b3 = (0, N 2 , 1),

A 3-Dimensional Lattice Reduction Algorithm

3

185

Definition of Reduced Basis

Definition 2. We say that a basis b1 , b2 , b3 of a 3-dimensional lattice L in Rn , n ≥ 3, is reduced if its vectors satisfy 1. |b1 | ≤ |b2 | ≤ |b3 |; 2. |b2 + x1 b1 | ≥ |b2 | and |b3 + x2 b2 + x1 b1 | ≥ |b3 | for all integers x1 , x2 . Thus a reduced basis is 2-reduced. This deﬁnition is equivalent to that of the Minkowski reduced basis as follows from [1]. Thus b1 is the shortest nonzero vector of L. It follows that λ(L) = |b1 | ≤ 21/6 ∆(L)1/3 . Algorithm 2 (Algorithm for Reducing). Input: Basis vectors b1 , b2 , b3 of a 3-dimensional lattice Rn , n ≥ 3. Output: A reduced basis b1 , b2 , b3 of this lattice. Step 1. (find a nonreduced pair) If bi , bj is not reduced for some i, j ∈ {1, 2, 3}, then go to Step 2, otherwise go to Step 3. Step 2. (reduce the pair) Evaluate a, b = G(bi , bj ), replace bi , bj ← a, b, and go to Step 1. Step 3. (reduce the basis) If 12 13 23 = −1, then go to Step 4, else evaluate a = b1 − 12 b2 − 13 b3 . If |a| < max{|b1 |, |b2 |, |b3 |} = |bi |, then replace bi ← a. Step 4. (order the vectors) Order the vectors b1 , b2 , b3 by increasing value of their norm. Remark 3. This algorithm uses the previous Algorithm 1. It can take as many as O(log3 M ) binary operations to ﬁnd a reduced basis for b1 , b2 , b3 ∈ Zn , n ≥ 3, where |b1 |, |b2 |, |b3 | ≤ M . We are going to prove that Algorithm 2 really ﬁnds a reduced basis. We need only prove the following statements. Proposition 1. Let b1 , b2 , b3 ∈ Rn , n ≥ 3, be a 2-reduced basis of some lattice. Then this basis is reduced or 12 13 23 = −1 and |b1 − 12 b2 − 13 b3 | < max{|b1 |, |b2 |, |b3 |}. Proposition 2. Let b1 , b2 , b3 ∈ Rn , n ≥ 3, be a 2-reduced basis of some lattice, and assume that |a| < max{|b1 |, |b2 |, |b3 |} = |bi |,

where

a = b1 − 12 b2 − 13 b3 .

Then replacing bi by a and ordering the vectors, we get a reduced basis.

186

Igor Semaev

These two propositions follow from Theorem 1. Theorem 1. Let b1 , b2 , b3 ∈ Rn , n ≥ 3, be a 2-reduced basis of some lattice such that |b1 | ≤ |b2 | ≤ |b3 |. If for some integers x1 , x2 we have |b3 + x1 b1 + x2 b2 | < |b3 |,

(3)

then 12 13 23 = −1,

x1 = −13 , and

x2 = −23 .

Proof. From (3) we get |b1 |2 x21 + |b2 |2 x22 + 2(b1 , b3 )x1 + 2(b2 , b3 )x2 + 2(b1 , b2 )x1 x2 < 0.

(4)

To prove this theorem we need a lemma. Lemma 3. If at least one of the last three summands in the lefthand side of (4) is non-negative, then this inequality is impossible. Proof. Let (b1 , b3 )x1 ≥ 0. Then 0 > |b1 |2 x21 + |b2 |2 x22 − 2|(b2 , b3 )x2 | − 2|(b1 , b2 )x1 x2 | ≥ |b1 |2 x21 + |b2 |2 x22 − |b2 |2 |x2 | − |b1 |2 |x1 x2 |. This inequality is impossible for |x1 | ≥ |x2 |. Let |x1 | < |x2 |. Then |b1 |2 |x1 | |x2 | − |x1 | > |b2 |2 |x2 | |x2 | − 1 . Hence |x2 | − |x1 | > |x2 | − 1 and |x1 | < 1. So x1 = 0. Therefore |b3 + x2 b2 | < |b3 |. This contradicts Lemma 1 and the theorem’s condition. Similarly, we consider the case (b2 , b3 )x2 ≥ 0. Let now (b1 , b2 )x1 x2 ≥ 0. Then 0 > |b1 |2 x21 + |b2 |2 x22 − 2|(b2 , b3 )x2 | − 2|(b1 , b3 )x1 | ≥ |b1 |2 (x21 − |x1 |) + |b2 |2 (x22 − |x2 |). This inequality is impossible for integers x1 , x2 . Thus the lemma is proved. Let us prove the theorem. If 12 13 23 = −1, then by changing signs of the vectors b1 , b2 , b3 , we get (b1 , b2 ) ≥ 0,

(b1 , b3 ) ≥ 0,

(b2 , b3 ) ≥ 0.

According to Lemma 3, the inequality (4), and so (3), are impossible. Let 12 13 23 = −1. Then by changing signs of the vectors b1 , b2 , b3 , we get (b1 , b2 ) > 0,

(b1 , b3 ) > 0,

(b2 , b3 ) < 0.

Indeed one can replace b2 by 12 b2 and b3 by 13 b3 . According to (3), we need consider only the case x1 < 0 and x2 > 0. From (4) it follows that 0 > |b1 |2 x21 + |b2 |2 x22 − 2(b1 , b3 )x1 − 2|(b2 , b3 )|x2 + 2(b1 , b2 )|x1 |x2 ≥ |b1 |2 x21 + |b2 |2 x22 − |b1 |2 |x1 | − |b2 |2 x2 − |b1 |2 |x1 |x2 ≥ |b1 |2 x21 − |x1 | + x22 − x2 − |x1 |x2 .

A 3-Dimensional Lattice Reduction Algorithm

187

Hence x21 − |x1 | + x22 − x2 − |x1 |x2 < 0

and

2 |x1 | − x2 + |x1 |x2 < |x1 | + x2 .

The inequality |x1 |x1 < |x1 |+x2 is valid only for |x1 | = 1 or x2 = 1. For example, in the last case x21 − 2|x1 | < 0, so |x1 | ≤ 1. Therefore x1 = −1 and x2 = 1. We have in both cases |b3 − b1 + b2 | < |b3 |. Finally, for the initial basis we obtain |b3 − 13 b1 − 23 b2 | < |b3 |. This completes the proof of Theorem 1. Let us prove Proposition 1. Suppose that the basis b1 , b2 , b3 is not reduced. Then 12 13 23 = −1 and the basis b1 , b2 , b3 is also not reduced, where b1 = b1 , b2 = −12 b2 , and b3 = −13 b3 . We note that (b1 , b2 ) < 0,

(b1 , b3 ) < 0,

(b2 , b3 ) < 0.

Then by Theorem 1, |b1 + b2 + b3 | < max |b1 |, |b2 |, |b3 | . Proposition 1 follows. Let us prove Proposition 2. It suﬃces to deal with the case 12 = 13 = 23 = −1. Let {1, 2, 3} = {i, j, k}. Then a = bi + bj + bk . We note that (a, bj ) = |bj |2 + (bi , bj ) + (bk , bj ) 1 = |bj |2 + 2(bi , bj ) + |bj |2 + 2(bk , bj ) 2 ≥0 for all j with 1 ≤ j ≤ 3, since bi , bj and bk , bj are reduced. If the pair a, bj with j = i is not reduced, then by Lemma 2, |a − bj | = |bi + bk | < max |a|, |bj | ≤ |bi |. This is a contradiction, since the pair bi , bk is reduced. So bj , bk , a is a 2-reduced basis. Let us show that it is reduced. If this is not the case, then according to Proposition 1, |a − bj − bk | = |bi | < max |b1 |, |b2 |, |b3 | ≤ |bi |. This contradiction completes the proof of Proposition 2.

188

4

Igor Semaev

The Algorithm

Algorithm 3 (Algorithm for Reducing). Input: Basis vectors b1 , b2 , b3 of a 3-dimensional lattice in Rn , n ≥ 3, ordered such that |b1 | ≤ |b2 | ≤ |b3 |. Output: A reduced basis b1 , b2 , b3 of this lattice. Step 1. (reduce the pair b1 , b2 ) Evaluate a, b = G(b1 , b2 ), replace b1 , b2 ← a, b. Step 2. (find a minimum of |b3 +x2 b2 +x1 b1 |) Compute integers x1 , x2 such that |b3 + x2 b2 + x1 b1 | is minimal. We have |x2 − y2 | ≤ 1 and |x1 − y1 | ≤ 1, where (b2 , b3 ) (b1 , b2 ) (b1 , b3 ) − · |b |2 |b2 |2 |b1 |2 , y2 = − 2 (b1 , b2 ) (b1 , b2 ) 1− · |b1 |2 |b2 |2

(b1 , b3 ) (b1 , b2 ) (b2 , b3 ) − · |b |2 |b1 |2 |b2 |2 y1 = − 1 . (5) (b1 , b2 ) (b1 , b2 ) 1− · |b1 |2 |b2 |2

Set a = b3 + x2 b2 + x1 b1 . Step 3. (replace b3 ← a) If |a| ≥ |b3 |, then terminate, else replace b3 ← a. Order b1 , b2 , b3 such that |b1 | ≤ |b2 | ≤ |b3 | and go to Step 1. Remark 4. We suppose that the basis b1 , b2 , b3 is deﬁned also by numbers |b1 |2 , |b2 |2 , |b3 |2 , (b1 , b2 ), (b1 , b3 ), (b2 , b3 ). We change the numbers in each step when changing the basis. Remark 5. Deﬁnition 2 and Algorithm 3 can be extended to higher dimension. Generally it is not clear if one could obtain the shortest vector of a lattice in so doing. Lemma 4. Let b1 , b2 , b3 be linearly independent vectors in Rn , n ≥ 3, such that |b1 | ≤ |b2 | ≤ |b3 | and 2|(b1 , b2 )| ≤ |b1 |2 . Let x1 , x2 be integers such that |b3 + x2 b2 + x1 b1 | is minimal. If y1 and y2 are defined by (5), then |x2 − y2 | ≤ 1

and

|x1 − y1 | ≤ 1.

Proof. It is easy to see that real y1 , y2 such that |b3 + y2 b2 + y1 b1 | is minimal are deﬁned by (5). So for integers x1 , x2 we have |b3 + x2 b2 + x1 b1 |2 = |b3 + y2 b2 + y1 b1 |2 + |(x2 − y2 )b2 + (x1 − y1 )b1 |2 . Let yi − yi = i for 1 ≤ i ≤ 2, so |i | ≤ 12 . By assumption |2 b2 + 1 b1 |2 ≥ |(x2 − y2 )b2 + (x1 − y1 )b1 |2 . Hence 0 ≥ (x2 − y2 )2 − 22 |b2 |2 + 2 (x2 − y2 )(x1 − y1 ) − 1 2 (b1 , b2 ) + (x1 − y1 )2 − 21 |b1 |2 .

A 3-Dimensional Lattice Reduction Algorithm

189

By assumption 2|(b1 , b2 )| ≤ |b1 |2 . Then 0 ≥ (x2 − y2 )2 − 22 |b2 |2 − |x2 − y2 ||x1 − y1 |+ |1 2 | |b1 |2 + (x1 − y1 )2 − 21 |b1 |2 . Hence (x2 − y2 )2 − |x2 − y2 ||x1 − y1 | + (x1 − y1 )2 ≤ 22 + |1 2 | + 21 ≤

3 , 4

since (x2 − y2 )2 − 22 ≥ 0 for any integer x2 and |b2 |2 ≥ |b1 |2 . It follows that 2 |x1 − y1 | 3 3 + |x1 − y1 |2 ≤ . |x2 − y2 | − 2 4 4 Therefore |x1 − y1 | ≤ 1. Similarly |x2 − y2 | ≤ 1. The lemma is proved. Lemma 5. Let the basis b1 , b2 , b3 ∈ Zn , n ≥ 3, satisfy the assumptions of Lemma 4. Let r be the minimal natural number such that |(b1 , b3 )| ≤r |b1 |2 Then in

and

|(b2 , b3 )| ≤ r. |b2 |2

T = O (log r + 1) log |b3 | binary operations,

one can find y1 , y2 with an accuracy of a few digits after the binary point. Proof. It is easy to see that |yi | ≤ O(r), 1 ≤ i ≤ 2. To ﬁnd y1 one computes integers r1 , r2 , s1 , s2 such that (b1 , b3 ) = r1 |b1 |2 + s1 ,

0 ≤ s1 < |b1 |2 ,

(b2 , b3 ) = r2 |b2 |2 + s2 ,

0 ≤ s2 < |b2 |2 .

It takes T binary operations since |r1 |, |r2 | ≤ r. Then one computes integers r3 , s3 such that 0 ≤ s3 < |b1 |2 . (b1 , b2 )r2 = r3 |b1 |2 + s3 , This takes T binary operations as well. Thus we ﬁnd the numerator for y1 by (b1 , b3 ) (b1 , b2 ) (b2 , b3 ) s1 r2 s2 − · = r1 + − (b1 , b2 ) − (b1 , b2 ) |b1 |2 |b1 |2 |b2 |2 |b1 |2 |b1 |2 |b1 |2 |b2 |2 s1 s3 s2 = r1 − r3 + − − (b1 , b2 ) |b1 |2 |b1 |2 |b1 |2 |b2 |2 = r1 − r3 + δ, where |δ| ≤ 32 . One needs a few digits of δ after the binary point. Similarly, one ﬁnds the denominator for y1 with an accuracy of O(log r + 1) binary digits. This takes T binary operations. To ﬁnd y1 one has to again divide with remainder two numbers. This takes T binary operations also. Similarly we ﬁnd y2 in T binary operations. The lemma is proved.

190

Igor Semaev

Theorem 2. Let b1 , b2 , b3 ∈ Zn ,n ≥ 3, be linearly independent vectors such |b3 | that |b1 | ≤ |b2 | ≤ |b3 |. Then in O log + 1 steps, Algorithm 3 finds a basis |b1 | b1 , b2 , b3 which is reduced or satisfies |b1 | ≤ |b2 | ≤ |b3 | ≤ |b1 | and 2|b3 |2 ≤ |b3 |2 . |b3 | This calculation takes O log + 1 log |b3 | binary operations. |b1 | We will prove Theorem 2 later in Section 5. Corollary 1. Let b1 , b2 , b3 ∈ Zn , n ≥ 3, satisfying |b1 | ≤ |b2 | ≤ |b3 | be a basis of some 3-dimensional lattice. Let a be the shortest in this lattice. nonzero vector |b3 | + 1 log |b3 | binary Then Algorithm 3 finds some reduced basis in O log |a| operations. |b3 | Proof. Form Theorem 2 it follows that the algorithm does s = O log +1 |a| steps to ﬁnd a reduced basis. To ﬁnd a basis b1 , b2 , b3 such that |b1 | ≤ |b2 | ≤ |b3 | ≤ |b1 | and 2|b3 |2 ≤ |b3 |2 , |b3 | one needs O log + 1 log |b3 | binary operations. To ﬁnd a basis b1 , b2 , b3 |b1 | satisfying and 2|b3 |2 ≤ |b3 |2 |b1 | ≤ |b2 | ≤ |b3 | ≤ |b1 | |b | takes O log 3 + 1 log |b3 | binary operations, and so on. Generally it takes |b1 | (s−1) |b3 | |b3 | |b3 | log |b3 | O s + log + log + · · · + log |b1 | |b1 | |a| (s−1) |b3 | |b3 | |b3 | + log + · · · + log (s−1) log |b3 | =O s + log |a| |b1 | |b1 | |b3 | + 1 log |b3 | =O log |a| binary operations. This concludes the proof.

5

Proof of Theorem 2

We begin with the proof of the following auxiliary proposition. Theorem 3. Let b1 , b2 , b3 be linearly independent vectors in Rn , n ≥ 3, such that |b1 | ≤ |b2 | ≤ |b3 | and 0 ≤ 2(b1 , b2 ) ≤ |b1 |2 ,

|(b1 , b3 )| < |b1 |2 ,

|(b2 , b3 )| < |b2 |2 .

Let x1 , x2 be integers with |b3 + x2 b2 + x1 b1 | < |b3 |.

(6)

A 3-Dimensional Lattice Reduction Algorithm

191

(a) If (b1 , b3 ) ≥ 0 and (b2 , b3 ) ≥ 0, then the integers x1 , x2 are defined by x1 = −1, −1, −2,

0, −1,

x2 = −1, −2, −1, −1,

1,

1, −1, −2,

0, −2, −1,

1,

1,

or if not, then 2|b1 |2 < |b2 |2 and x2 = −1. (b) If (b1 , b3 ) ≥ 0 and (b2 , b3 ) < 0, then the integers x1 , x2 are defined by x1 = 1, 0, −1, −1, −2, −3, −1, −2, −3, −1, −2, −3, −4, −3, x2 = 1, 1,

0,

1,

1,

1,

2,

2,

2,

3,

3,

3,

3,

4,

or if not, then 2|b1 |2 < |b2 |2 and x2 = 1. Proof. From (6) it follows that 0 > x22 |b2 |2 + x21 |b1 |2 + 2x2 (b2 , b3 ) + 2x1 (b1 , b3 ) + 2x1 x2 (b1 , b2 ).

(7)

Let us prove (a). If x1 = 0, then 0 > x22 |b2 |2 + 2x2 (b2 , b3 ). Hence x2 < 0 and 0 > x22 |b2 |2 − 2|x2 ||b2 |2 = (x22 − 2|x2 |)|b2 |2 . Therefore x2 = −1. Similarly, if x2 = 0, then x1 = −1. Let x1 , x2 < 0. It follows from (7) that 0 > x22 − 2|x2 | |b2 |2 + x21 − 2|x1 | |b1 |2 . Hence 0 > x22 − 2|x2 | or 0 > x21 − 2|x1 |. In the ﬁrst case x2 = −1. Then 0 > −|b2 |2 + x21 − 2|x1 | |b1 |2 . If |x1 | ≥ 3, then 2|b1 |2 < |b2 |2 and (a) is proved. Thus x1 = −1 or x1 = −2. Let 0 > x21 − 2|x1 |. Then x1 = −1 and 0 > x22 − 2|x2 | |b2 |2 − |b1 |2 . Then |x2 | ≤ 2, so x2 = −1 or x2 = −2. If x1 , x2 > 0, then (7) is impossible. Let x1 < 0 and x2 > 0. From (7) it follows that 0 > x22 |b2 |2 + x21 − |x1 |(2 + x2 ) |b1 |2 . So |x1 | < 2 + x2 . Since |b2 |2 ≥ |b1 |2 , we have x2 = 1. Therefore x1 = −1 or x1 = −2. Let x1 > 0 and x2 < 0. From (7) it follows that 0 > x22 − 2|x2 | |b2 |2 + x21 − x1 |x2 | |b1 |2 . So 0 > x22 − 2|x2 | or 0 > x21 − x1 |x2 |. In the ﬁrst case x2 = −1. If x1 ≥ 2, then from 0 > −|b2 |2 + (x21 − x1 )|b1 |2 we have 2|b1 |2 < |b2 |2 and (a) is proved. Thus x1 = 1. Let 0 > x21 − x1 |x2 |, so x1 < |x2 |. From |x2 | ≥ 2, we have only x2 = −2 and x1 = 1. This completes the proof of the ﬁrst case of the theorem. The proof of (b) is similar.

192

Igor Semaev

Let b1 , b2 , b3 be linearly independent vectors in Rn , n ≥ 3, such that |b1 | ≤ |b2 | ≤ |b3 |. Let M = min |b3 + y2 b2 + y1 b1 | . y1 ,y2 ∈Z

Corollary 2. Under the conditions of Theorem 3 we have 2|b1 |2 < |b2 |2 or one of the following conditions holds: (a) If (b1 , b3 ) ≥ 0 and (b2 , b3 ) ≥ 0, then M = |b3 − b1 |

or

M = |b3 − b2 |

or

M = |b3 − b2 − b1 |.

(b) If 2|(b3 , b1 )| ≤ |b1 |2 , then M = |b3 − 23 b2 |

or

M = |b3 − 23 b2 − 13 b1 |.

or

M = |b3 − 23 b2 − 13 b1 |.

(c) If 2|(b3 , b2 )| ≤ |b2 |2 , then M = |b3 − 13 b1 | Here ij = sgn(bi , bj ). Proof. Let 2|b1 |2 ≥ |b2 |2 . Consider (a). Let M = |b3 + x2 b2 + x1 b1 |. Then x1 , x2 are deﬁned by the ﬁrst case of Theorem 3. We note that |b3 − b2 − b1 | < |b3 − 2b2 − b1 |, |b3 − b2 − 2b1 |, |b3 − b2 | ≤ |b3 − b2 + b1 |, |b3 − 2b2 + b1 |, |b3 − b1 | ≤ |b3 + b2 − b1 |, |b3 + b2 − 2b1 |. Thus (a) is true. The proof of (b) and (c) is similar. Proof (Outline of the proof of Theorem 2). In Step 1 of the algorithm we reduce the pair b1 , b2 . So we can consider only the case 2|(b1 , b2 )| ≤ |b1 |2 . In Step 2 we ﬁnd integers x1 , x2 such that and |a| = min |b3 + y2 b2 + y1 b1 | . a = b3 + x2 b2 + x1 b1 y1 ,y2 ∈Z

Using Corollary 2, we can reduce the proof to the case |b1 | ≤ |a|. If |b1 | ≤ |b2 | ≤ |a|, then the basis b1 , b2 , a is reduced. Let |b1 | ≤ |a| < |b2 |. Hence the pair b1 , a is reduced, so 2|(b1 , a)| ≤ |b1 |2 . In Step 2 we ﬁnd integers x1 , x2 such that and |a | = min |b2 + y2 a + y1 b1 | . a = b2 + x2 a + x1 b1 y1 ,y2 ∈Z

If |a | ≥ |a|, then the basis b1 , a, a is reduced. Let |a | < |a|. We note that if |(b2 , a)| ≥ |a|2 ,then (b2 , a) 1 |a |2 ≤ |b2 − ra|2 ≤ |b2 |2 for r = . 2 |a|2

A 3-Dimensional Lattice Reduction Algorithm

193

By Lemma 5, one can ﬁnd a in O (log |r| + 1) log |b3 | = O

|b2 | + 1 log |b3 | log |a|

binary operations, since |r| ≤ |b2 |/|a| by the Cauchy-Schwarz inequality. So the theorem can be proved in this case easily. Let |(b2 , a)| < |a|2 . Then by Theorem 3 and Corollary 2, there exist integers x1 , x2 , where |x2 | ≤ 1, such that a = b2 + x2 a + x1 b1

and

|a | = |a |.

So |a | ≥ |a|. This is a contradiction, which completes the proof of the theorem.

References 1. J.W.S. Cassels, Rational quadratic forms, Academic Press, London, New York, 1978. 2. H. Cohen, A course in computational algebraic number theory, Springer-Verlag, Berlin, Heidelberg, 1993. 3. F. Eisenbrand, Fast reduction of ternary quadratic forms, this volume. 4. A.K. Lenstra, H.W. Lenstra, and L. Lovasz, Factoring polynomials with rational coeﬃcients, Math. Ann. 261 (1982), 515–534. 5. B. Vallee, An aﬃne point of view on minima ﬁnding in integer lattices of lower dimensions, Proc. of EUROCAL’87, LNCS 378, Springer-Verlag, Berlin, 1989, 376378.

The Shortest Vector Problem in Lattices with Many Cycles Mårten Trolin Department of Numerical Analysis and Computer Science Royal Institute of Technology, Stockholm, Sweden [email protected]

In this paper we investigate how the complexity of the shortest vector problem in a lattice Λ depends on the cycle structure of the additive group Zn /Λ. We give a proof that the shortest vector problem is n NP-complete in the max-norm for n-dimensional lattices Λ where Z /Λ has n − 1 cycles. We also give experimental data that show that the LLL algorithm does not perform signicantly better on lattices with a high number of cycles. Keywords: Lattices, LLL algorithm, shortest vector problem. Abstract

1 Introduction Lattices were examined already in the middle of the 19th century, at that time mostly because of their connections to quadratic forms. The interest in algorithmic aspects of lattice problems started in the beginning of the 1980s. In 1981, van Emde Boas [16] showed that nding the lattice point closest to a given point is NP-hard in r -norm for any r > 0. In the following year, Lenstra, Lenstra and Lovász [7] published their lattice basis reduction algorithm, which is guaranteed to nd a vector not more than an exponential factor longer than the shortest vector in polynomial time. This was a great achievement. Schnorr has improved approximation to a slightly sub-exponential factor [12]. The NP-hardness of the shortest vector problem in Euclidean norm was an open problem for a long time. It was proven to be NP-hard under randomized reductions by Ajtai in 1998 [2]. This result has been improved by several authors, and the strongest result today by Micciancio [8] is that the shortest √ vector problem is NP-hard to approximate within any factor smaller than 2 under randomized reductions. On the other hand, Goldreich and Goldwasser [4] √ have showed that this NP-hardness result cannot be extended to n unless the polynomial-time hierarchy collapses. A lattice can be described either by a basis that spans the lattice, or as the solutions x of a set of modular equations ai , x = 0 (mod ki ). Lattices can be classied after the cycle structure of the subgroup Zn /Λ. The number of cycles and the lengths of the cycles in this subgroup corresponds to the minimum number of equations and the moduli of the equations necessary to describe the lattice. Our main focus will be to investigate whether there is a dierence in the complexity of computing short vectors between lattices with dierent number of cycles. J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 194205, 2001.

c Springer-Verlag Berlin Heidelberg 2001

The Shortest Vector Problem in Lattices with Many Cycles

195

In 1996, Ajtai [1] published a paper in which it is shown that a random lattice from a certain set of lattices is at least as hard as a certain shortest vector problem in the worst case. This result has been improved in [3]. These n-dimensional lattices have n/c cycles, whereas a random lattice usually has one cycle. On the other hand, Schnorr and Paz [11] have shown in a worst-case result that any lattice can be approximated arbitrarily well by a lattice with one cycle. Schnorr's and Paz's result indicates that the lattices with one cycles are the hardest, whereas Ajtai's result gives evidence that also lattices with n/c cycles are hard (although the problem studied by Ajtai is of a dierent kind than the common shortest vector problem). This gives rise to the question on whether or not lattices with more cycles are easier, or whether the number of cycles is of no importance to the shortest vector problem. As far as we know, it has never previously been investigated how the cycle structure aects the complexity of lattice problems. Except for the lattice created by Ajtai [1], the previously published reductions that we know about [2,8,16] contain no analysis of the cycle structure of the lattices used. We will show that even for a large number of cycles the shortest vector problem is hard in the max-norm. We also give experimental data that indicate that the LLL lattice basis reduction algorithm does not perform signicantly better when applied on lattices with a high number of cycles. However, we still lack a theoretical explanation for these results.

2 Denitions

A lattice Λ is the set { ni=1 λi bi | λi ∈ Z} where the vectors bi ∈ Zn are linearly independent. The vectors bi 's are called a basis of the lattice, and the matrix B with the vectors bi 's as its rows is called a basis matrix for Λ. By Λ (b1 , b2 , . . . , bn ) we mean the lattice spanned by the basis {b1 , b2 , . . . , bn }. The determinant of a lattice is dened as det(Λ) = | det(B)|. The k -norm of n k 1/k a vector v is dened as vk = . We also dene the max-norm, i=1 |vi | ∞ -norm, as v∞ = maxni=1 |vi |. We can see that the 2 -norm is the Euclidean norm. In this report we will mainly consider the 2 -norm and the ∞ -norm. When we leave out the index we mean the 2 -norm. A vector v ∈ Λ is called a shortest lattice vector if v > 0 and for every vector u ∈ Λ either u ≥ v or u = 0. Moreover we dene the length of a shortest vector in Λ as λ(Λ) = v. We dene the length of a basis as the length of the longest vector in the basis. In the end of the 19th century, Minkowski [10] proved an upper bound on the length of the shortest vector in a lattice.

Theorem 1 (Minkowski's Inequality). Let

lattice. Then there is a constant γn so that λ(Λ) ≤

Λ ∈ Zn be an n-dimensional

√ γn (det(Λ))1/n .

196

Mårten Trolin

The least constant γn is called Hermite's constant of rank n, and it has been n n proved that γn ≤ πe [5]. It is also known that γn ≥ 2πe . An alternative way to describe a lattice is by giving a set of modular equation, that is, equations of the form ai , x = 0 (mod ki ), where a1 , a2 , . . . , am are ndimensional vectors. Any lattice can be written on this form. We will say that a lattice described by m modular equations with moduli k1 , k2 , . . . , km has m cycles of lengths k1 , k2 , . . . , km , provided that the equations are on as simple form as possible. More exactly, we demand that the coecients and the modulus are relative prime within each equation, and that ki |ki+1 , i = 1, 2, . . . , m − 1. If we construct a lattice by modular equations such that the moduli do not have this property, we can always combine the equations to become equations of this form, and this representation is easy to compute. The Smith normal form of a matrix [14] gives us the relation that the lengths of the cycles of a lattice is given by the determinant divisors of the basis matrix:

Theorem 2. Let Λ be a lattice and B its basis matrix. Then the lengths of the cycles of Λ, k1 , k2 , . . . , kn are given by ki =

di di−1

where di is gcd of all i-minors of B and d0 = 1.

3 Background and Previous Results 3.1 Complexity of Finding Short Vectors To the best of our knowledge, the rst result of NP-hardness of calculating short vectors in a lattice was published by van Emde Boas in 1981 [16], where it is proved NP-hard to calculate the shortest vector in ∞ -norm in a general lattice. The same problem for the 2 -norm was long an open problem, until proven NPhard under randomized reductions by Ajtai in 1998 [2]. Micciancio [8] improved this result by showing that it is NP-hard to approximate the shortest vector √ within a factor 2 − ε for any ε > 0 under randomized reductions.

3.2 On the Cycle Structure of lattices We will now state a few theorems on the cycle structure. These are probably well known, and we will therefore omit the proofs. Please note that some of the cycle lengths ki mentioned in the theorems may be 1.

Theorem 3. Let Λ ⊆ Zn be a lattice with cycle structure Zk

1

× Zk2 × · · · × Zkn .

Then the lattice d · Λ has the cycle structure Zd·k1 × Zd·k2 × · · · × Zd·kn .

The next theorem shows that we can always assume that the shortest cycle of a lattice has length 1.

The Shortest Vector Problem in Lattices with Many Cycles

197

Theorem 4. Let Λ ⊆ Zn be a lattice with cycle structure Zk

1 × Zk2 × · · · × Zkn , where k1 ≤ ki , i = 2, . . . , n. Then Λ = k1 · Λ , where Λ is a lattice with cycle structure Zk2 /k1 × Zk3 /k1 × · · · × Zkn /k1 .

3.3 Previous Results on the Cycle Structure Paz and Schnorr [11] have shown the following theorem, which essentially says that any lattice can be approximated arbitrarily well by a lattice described by a single modular equation. We will call these lattices cyclic.

Theorem 5. Let

Λ ∈ Zn be a lattice. Then for every ε > 0 we can eciently construct a linear transformation σΛ,ε : Λ → Zn such that σΛ,ε (Λ) is a lattice and for some integer k

1. u − σΛ,ε (u)/k ≤ εu for all u ∈ Λ, 2. σΛ,ε (Λ) has one cycle.

This theorem implies that the cyclic lattices, in some sense, are the hardest ones in the worst case. If we know a way of nding short vectors in cyclic lattices, this would give us a method of nding short vectors in any lattice. The average case/worst case connection described by Ajtai [1], the class of hard lattices consist of lattices with n/c cycles, where n is the dimension and c some constant. These rst results show that lattices with just one cycle are hard, but the latter seems to indicate that also lattices with relatively many cycles are hard. Hence it is natural to investigate the role of the cycle structure in complexity questions.

4 The LLL Algorithm in Practice In this section we will give data about the performance of the LLL algorithm in practice when applied to lattices with dierent number of cycles. The intention is to nd out whether or not the result of LLL depends on the cycle structure of the lattice. In all experiments, version 4.3 of the NTL library [13] was used.

4.1 Construction of Lattice Instances For the experiments, we need to construct lattices in such a way that we have control over the number of cycles in the lattices. The idea is to create a set of linear modular equations and compute the null space of this set of equations. To create an n-dimensional lattice with m cycles we create an m × n matrix A and set Λ = {x | Ax ≡ 0 (mod q)} .

198

Mårten Trolin

The elements of A are given by a shift register generator. In this register we create a stream of bits using xi+1 =

l

aj xi−j mod 2 .

j=1

The parameter a = (a1 , a2 , . . . , al ) is a constant to be chosen. Solving for the null space gives us n − m basis vectors. To ensure the basis contains n vectors, m rows of the matrix qIn are added to the basis. The dimensions of A determine the cycle structure of the lattice. With m rows in A, we get a lattice with m cycles of length q . To make it possible to compare the dierent lattices with each other, they were created in such a way that their determinants were equal. By Minkowski's inequality (theorem 1), this implies that the length of a shortest vector has the same upper bound. Also the expected length of the shortest vector is the same. More precisely, given the dimension n and the determinant d, the lattices were created as Λm = x | Ax ≡ 0 mod p d1/m

where p(x) is the smallest prime equal to or greater than x and A is an m × n matrix with random entries. Since the determinant is given by the product of the cycle lengths, we see that all the Λm have approximately the same determinant, which means that it makes sense to compare the results of the LLL algorithm on them. An important factor is how the starting point for LLL is chosen. When we compute the basis matrix from the null space and add m rows of the form qek for unit vectors ek , we get a basis where the last rows are much shorter than the rst ones. Micciancio [9] suggests the Hermite Normal Form (HNF) as a standard representation of a lattice. The HNF can be computed in polynomial time [15] and we can easily nd an upper bound for the coordinates. The basis derived from the null space is in already in HNF, and for the results presented use this basis is used as starting point for LLL.

4.2 Result of the LLL Algorithm In the experiments, the LLL algorithm was executed with 75-dimensional lattices created as explained above as input. The algorithm was executed at least four times for each number of cycles, and the length of the output vector was noted. The result is given in gures 1. The number of iterations needed by the algorithm to nish is given in gure 2. As we can see in gure 1, the length of the vector produced by the LLL algorithm does not seem to depend on the cycle structure of the lattice examined. From gure 2 it seems that the number of iterations needed by the LLL algorithm to nish in our experiments decreases with the number of cycles. Since the starting point for a lattice Λ of dimension n with m cycles contains vectors of length q ≈ m det(Λ), we get a better starting point for a higher

The Shortest Vector Problem in Lattices with Many Cycles

199

21

14

x 10

Length of vector produced by LLL

12

10

8

6

4

2

0 10

20

30

40 Number of cycles

50

60

70

Figure 1. Shortest Vector Found by LLL in 75-Dimensional Lattices with Constant Determinant. 5

4.5

x 10

4

Number of iterations

3.5

3

2.5

2

1.5

1 45

50

55

60 Number of cycles

65

70

75

Figure 2. Number of Iterations as Function of the Number of Cycles for a 75Dimensional Lattice.

200

Mårten Trolin

number of cycles. Experimental data indicate that once the LLL algorithm has reached a point where the length of the shortest vector is that of the starting point for lattice with a higher number of cycles, the progress of the algorithm is similar for both lattices.

5 Complexity of Computing Short Vectors in a Lattice with Many Cycles We will now present an NP-completeness proof for lattices with a maximum number of cycles. We will prove that even if an n-dimensional lattice has n − 1 cycles the problem of deciding whether there is a vector shorter than a given length in ∞ -norm is NP-complete. The problem that we will discuss is the following:

SVML∞ is the problem of nding a short vector in a lattice with maximal number of cycles. Let Λ ⊆ Zn be a lattice which has n − 1 cycles of equal length q , and let k ∈ Z. Then (Λ, k) is a yes-instance if there exists v ∈ Λ such that v∞ ≤ k, and a no-instance otherwise. Denition 1.

We will prove the following theorem

SVML∞ is NP-complete. We rst note that SVML∞ is in NP. Given a vector v we can in polyno-

Theorem 6.

Proof. mial time verify that v∞ ≤ k and that v ∈ Λ by solving the system of linear equations Bx = v where B is a basis matrix of Λ and check that x is integral. This can be done in polynomial time. Before we continue the proof, we introduce some notation. For any a ∈ R, dene {a} := |a mod Z| = min(|a − k|) . k∈Z

Informally, {a} is the distance from a to the closest integer. We also introduce a related notation for vectors. For any v ∈ Rn , dene n

{{v}} := v mod Zn ∞ = max ({vi }) . i=1

{{v}} can be seen as the distance between v and the closest integral vector, given that by distance we mean the max-norm. We prove that SVML∞ is NP-hard by reducing from good simultaneous Diophantine approximation in ∞ -norm, GDA∞, which was proven NP-hard by Lagarias [6]. GDA∞ is the following problem. Given a vector α ∈ Qn and integers N and s decide whether there exists an integer Q such that 1≤Q≤N

and

{{Qα}} ≤ 1/s .

The Shortest Vector Problem in Lattices with Many Cycles

201

In other words, given a vector of rational numbers, we want to nd good approximations to the components of this vector using rationals with a small common denominator. We note that we can always assume that α is of the form α=

a2 an ,..., . b b b

a

1

,

Should α not be of this form, we can always rewrite all its components using the least common denominator. We start by proving that a revision of GDA∞, rGDA∞, is NP-hard.

Denition 2. rGDA∞ is the following problem: Given integers s, q and N and a vector β = (k1 , k2 , . . . , kn )/B ∈ Qn where B = N 2 s(s − 2)q , decide whether there exists an integer Q such that 1 ≤ Q ≤ N 2 (s − 2)q +

and {{Qβ}} ≤

N 2

1 1 + . s 2N s(s − 2)q

rGDA∞ is NP-hard. We reduce GDA∞ to rGDA∞. Let α, N and s be an instance of GDA∞.

Lemma 1.

Proof. Assume b is the common denominator of α. Let c be the least integer such that 1/s < c/b. Now choose q as the least integer for which

and

1 1 c + < s N s(s − 2)q b (s − 2)q > N

and let B = N 2 s(s − 2)q . In other words, we choose q so that there is no multiple of 1/b in the interval [1/s, 1/s + N/B). Let the vector β = (k1 , k2 , . . . , kn )/B

with integral components k1 , k2 , . . . , kn be such that α − β ∞ is minimized. This can be done in polynomial time using ordinary division. It is easy to see that α − β ∞ ≤ 1/(2B). We now dene a new vector β=

1 1 1 1 1 1 , ,..., , , . . . , , β, , N s N s(s − 2) N s(s − 2)q N 2 s N 2 s(s − 2) N 2 s(s − 2)q

that is, we append some new elements to the vector β .

202

Mårten Trolin

We see that β , N , q and s form an instance of rGDA∞. Since q is logarithmic in N , β is not more than polynomially larger than α. Also the bit size of the common denominator does not grow more than polynomially. We want to prove that Q is a solution of this rGDA∞ problem if and only if it is a solution of this original GDA∞ problem. Let Q be a solution of the rGDA∞ instance. We want to prove that Q also is a solution of the original GDA problem. We rst prove that Q ≤ N . We know that 1/(N s) is a component of β . Since Q is a solution,

Q

1 Ns

≤

1 1 + . s 2s(s − 2)q

This implies that either Q

1 1 1 ≤ + Ns s 2s(s − 2)q

Q

1 ≥1− Ns

or

1 1 + s 2s(s − 2)q

,

which can be rewritten as Q≤N+

or

N 2(s − 2)q

Q ≥ Ns − N −

N . 2(s − 2)q

Since Q is integral, these two conditions imply that Q≤N

or Q ≥ N (s − 1). 1 We also have that N s(s−2) is a component of β . The corresponding calculations for this component show that

Q ≤ N (s − 2) < N (s − 1)

or Q ≥ N (s − 2)(s − 1).

We can use the same reasoning for the components βn+1 up to βn+q+1 (remember that βn+q+1 = 1/ (N s(s − 2)q )), which shows that either Q≤N

or Q ≥ N (s − 2)q (s − 1) −

N . 2

The Shortest Vector Problem in Lattices with Many Cycles

203

We do the same thing with βn+q+2 = 1/(N 2 s), which gives us that either Q ≤ N2

or Q > N 2 (s − 2) .

Since (s − 2)q > N this implies together with the previous results that Q > N 2 (s − 2) unless Q ≤ N . Going through the remaining components we nally get that Q≤N

or Q ≥ N 2 (s − 2)q (s − 1) −

N . 2

Since we in the denition of the problem stated that Q ≤ N 2 (s − 2)q + N/2, the only remaining possibility is that Q ≤ N . We now prove that {{Qα}} ≤ 1/s. We observe that {{Qα}} = k/b for some integer k (remember that b is the common denominator of α). We know that {Qβ } ≤ {Qβ} ≤ 1/s + 1/(2B). Since the distance between α and β is at most 1/(2B) we can conclude that {{Qα}} ≤ {{Qβ }} + Q

1 2B

1 1 1 + + q s 2N s(s − 2) 2N s(s − 2)q 1 1 = + . s N s(s − 2)q ≤

But, as we just stated, the approximation error in α is always a multiple of 1/b and since we have chosen q such that 1/s + 1/(N s(s − 2)q ) does not pass a 1/b boundary, this must indeed be {{Qα}} ≤

1 . s

This concludes the proof that Q is a solution of the GDA∞ instance if it is a solution of the rGDA∞ instance. Now assume that Q is a solution of the GDA∞ instance. This means that {Qα} ≤ 1/s and Q ≤ N . We rst note that {Qβi } ≤ Qβi ≤ N βi ≤ 1/s for i = n + 1, . . . , n + 2q + 2, i.e., the appended components. This means that we only need to consider β . We know that α − β ∞ ≤ 1/(2B), which means that {{Qβ }} ≤ {{Qα}} + Q

1 1 1 ≤ + 2B s 2N s(s − 2)q

and we can conclude that Q is a solution of the rGDA∞ problem.

204

Mårten Trolin

This proves that the reduction is correct. We now turn to the proof of the

NP-hardness of SVML∞. We do this by reducing from rGDA∞. Let β , N and

rGDA

k1 k2 kn s be an instance of ∞ , with β = B , B , . . . , B . We create the lattice with the following (n + 1) × (n + 1) matrix as its basis matrix (the basis vectors

are the rows of the matrix)



1/B k1 /B k2 /B  0 1 0   0 0 1 A=  .. . .. .  . . . 0 0 0

 . . . kn /B ... 0   ... 0   . ..  .. . .  ... 1

If we multiply this lattice by B we get an (n + 1)-dimensional integral lattice. According to theorem 2, the lattice B · A has n cycles of length B . This means that B · A and B/s + B/(2N s(s − 2)q ) is an instance of SVML∞ . We now want to prove that this SVML∞ instance is a yes instance if and only if the original rGDA∞ is a yes instance. Assume that the SVML∞ instance is a yes instance, i.e., there is a Q such that

max Q

1 , {{Qβ}} B

≤

1 1 + s 2N s(s − 2)q

which implies that {{Qβ}} ≤

1 1 + s 2N s(s − 2)q

and Q ≤ N 2 (s − 2)q +

so Q is a solution of the rGDA∞ instance. Assume that the rGDA∞ instance is a N 2 (s − 2)q + N/2 such that {{Qβ}} ≤

We can calculate Q

N 2

yes instance. Then there is a Q ≤

1 1 + . s 2N s(s − 2)q

1 1 1 ≤ + B s 2N s(s − 2)q

which implies that

1 1 1 max Q , {{Qβ}} ≤ + , B s 2N s(s − 2)q

i.e., the SVML∞ instance is a yes instance. This concludes the proof that SVML∞ is NP-complete.

The Shortest Vector Problem in Lattices with Many Cycles

205

Acknowledgements I would like to thank Johan Håstad for valueable feedback and ideas during the preparation of this paper. I would also like to thank the anonymous referees for pointing out mistakes and possible improvements.

References 1. M. Ajtai. Generating Hard Instances of Lattice Problems. Proc. 28th ACM Symposium on Theory of Computing, pages 99108, 1996. 2. M. Ajtai. The shortest vector problem in 2 is NP-hard for randomized reductions. Proc. 30th ACM Symposium on the Theory of Computing, pages 1019, 1998. 3. J-Y. Cai and A. Nerurkar. An Improved Worst-Case to Average-Case Connection for Lattice Problems. Proc. 38th IEEE Symposium on Foundations of Computer Science, pages 468477, 1997. 4. O. Goldreich and S. Goldwasser. On the limits of non-approximability of lattice problems. Journal of Computer and System Sciences, Academic Press, 60(3):540 563, 2000. Can be obtained from http://www.eccc.uni-trier.de/eccc . 5. Kabatjanskii and Levenshtein. Bounds for Packings on a Sphere and in Space. Problems of Information Transmission 14, 1:117, 1978. 6. J.C. Lagarias. The Computational Complexity of Simultanous Diophantine Approximation Problems. SIAM Journal of Computing, 14:196209, 1985. 7. A.K. Lenstra, H.W. Lenstra and L. Lovász. Factoring Polynomials with Rational Coecients. Mathematische Annalen 261:515534, 1982. 8. D. Micciancio. The Shortest Vector in a Lattice is Hard to Approximate within Some Constant. Proc. 39th IEEE Symposium on Foundations of Computer Science, 1998, 9298. 9. D. Micciancio. Lattice Based Cryptography: A Global Improvement. Technical report, Theory of Cryptography Library, 1999. Report 99-05. Can be obtained from http://eprint.iacr.org . 10. H. Minkowski. Über die positiven quadratischen Formen und über kettenbruchhnliche Algorithmen. Crelles Journal für die Reine und Angewandte Mathematik, 107:278297, 1891. 11. A. Paz and C.P. Schnorr. Approximating Integer Lattices by Lattices with Cyclic Lattice Groups. Automata, languages and programming (Karlsruhe), 1987, 386 393. 12. C.P. Schnorr. A Hierarchy of Polynomial Time Lattice Basis Reduction Algorithms. Theoretical Computer Science, 53:201224, 1987. 13. V. Shoup. NTL: A Library for doing Number Theory. Can be obtained from http://www.shoup.net . 14. H.J.S. Smith. On Systems of Linear Indeterminate Equations and Congruences. Philosophical Transactions of the Royal Society of London, 151:293326, 1861. 15. A. Storjohann and G. Labahn. Asymptotically Fast Computation of Hermite Normal Forms of Integer Matrices. ISAAC'96, 1996, 259266. 16. P. van Emde Boas. Another NP-complete partition problem and the copmlexity of computing short vectors in lattices. Technical Report 81-04. Mathematics Department, University of Amsterdam, 1981. Can be obtained from http://turing.wins.uva.nl/~peter .

Multisequence Synthesis over an Integral Domain Li-ping Wang1 and Yue-fei Zhu2? 1

State Key Laboratory of Information Security, Graduate School University of Science and Technology of China, Beijing 100039, China [email protected] 2 Department of Network Engineering Information Engineering University, Zhengzhou 450002, China [email protected]

Abstract. We first give an extension of F [x]-lattice basis reduction algorithm to the polynomial ring R[x] where F is a field and R an arbitrary integral domain. So a new algorithm is presented for synthesizing minimum length linear recurrence (or minimal polynomials) for the given multiple sequences over R. Its computational complexity is O(N 2 ) multiplications in R where N is the length of each sequence. A necessary and sufficient conditions for the uniqueness of minimal polynomials are given. The set of all minimal polynomials is also described.

1

Introduction

In this paper we investigate the problem of multisequence linear recurrence synthesis over an arbitrary integral domain R. It is of importance in coding theory, cryptography and signal processing field. Fitzpatrick and Norton gave an algorithm when R is a potential domain, i.e. both R and R[[x]] are unique factorization domains [1]. Lu and Liu presented a method to find shortest linear recurrence over unique factorization domain by means of Gr¨ obner basis theory [2]. Furthermore, Norton proposed an algorithm over an arbitrary integral domain [3]. However, the above algorithms are only used to solve the problem of single-sequence synthesis. By means of F [x]-lattice basis reduction algorithm [4], in [5] we gave a new multisequence synthesis algorithm over a field F . F [x]lattice basis reduction algorithm can be consider as a generalization of famous LLL algorithm [6], which has been widely used in computational number theory and cryptography. Especially LLL algorithm is often used to attack some cryptosystems such as knapsack schemes [7] and RSA system [8]. Our results are an application to coding theory and cryptography about F [x]-lattice basis reduction algorithm. But it fails when applied to an integral domain. In the next section, we present a R[x]-lattice basis reduction algorithm and some properties about reduced basis. In Section 3, we give an algorithm to solve this synthesis problem. Furthermore, we develop a necessary and sufficient conditions for the ?

Research supported by NSF under grants No. 19931010 and G 1999035803.

J.H. Silverman (Ed.): CaLC 2001, LNCS 2146, pp. 206–217, 2001. c Springer-Verlag Berlin Heidelberg 2001

Multisequence Synthesis over an Integral Domain

207

uniqueness of minimal polynomials. When the solution is not unique, we describe the set of all minimal polynomials. First we formulate the problem. Let R be an integral domain and a = (a1 , · · · , aN ) be a sequence with length N over R. A polynomial d X

q(x) =

ci xi ∈ R[x]

i=0

is an annihilating polynomial of a if cd ak + cd−1 ak−1 + · · · + c0 ak−d = 0

for all k, d < k ≤ N .

(1)

A minimal polynomial of a is defined to be an annihilating polynomial with least degree. Its degree is called the linear complexity of a and indicates the minimum length of a linear recurrence capable of generating a. Let a(1) , a(2), · · · , a(m) be m sequences over R. A polynomial q(x) is an annihilating polynomial of a(1), a(2), · · · , a(m) if q(x) is an annihilating polynomial for each a(i) , 1 ≤ i ≤ m. A minimal polynomial of a(1), a(2), · · · , a(m) is defined to be an annihilating polynomial with least degree. For brevity, Ann(a(1) , a(2), · · · , a(m) ) denotes the set of all annihilating polynomials of a(1), a(2), · · · , a(m) . The multisequence synthesis problem of a(1), a(2), · · · , a(m) is to find one of their minimal polynomials. Throughout the paper, we denote (i)

(i)

(i)

a(i) = (a1 , a2 , · · · , aN ), (i)

where aj ∈ R, for 1 ≤ i ≤ m and 1 ≤ j ≤ N . Let X ∞ ai x−i i0 ∈ Z, ai ∈ R . A = R((x−1 )) = i=i0

Obviously A is a formal power-negative series ring. Since R is an integral domain, then so is A. We define a map v:A −→ Z ∪ {∞} ∞ X ∞ if a(x) = 0 −i ai x 7−→ a(x) = min{i|ai 6= 0} otherwise i=i0

For arbitrary elements a(x), b(x) ∈ A, then v satisfies 1. v(a(x)) = ∞ if and only if a(x) = 0. 2. v(a(x) · b(x)) = v(a(x)) + v(b(x)). 3. v(a(x) + b(x)) ≥ min{v(a(x)), v(b(x))}, with equality if v(a(x)) 6= v(b(x)). we also call v a valuation on A. If a = (a1 , · · · , aN ), then a(x) = P∞Therefore −j a · x ∈ A is the associated formal negative-power series of a. We give a j=1 j lemma similar to Lemma 1 [5].

208

Li-ping Wang and Yue-fei Zhu

Lemma 1. Let a(1) (x), a(2)(x), · · · , a(m) (x) be the associated formal negativepower series of a(1), a(2), · · · , a(m) respectively, and let q(x) be a polynomial over R with degree d. Then q(x) ∈ Ann(a(1) , a(2), · · · , a(m) ) if and only if for each i, 1 ≤ i ≤ m, there exists a unique polynomial pi (x) ∈ R[x] such that v(q(x) · ai (x) − pi (x)) > N − d

(2)

Lemma 1 reduces the multisequence synthesis problem of a(1) , a(2), · · · , a(m) to finding a polynomial of least degree satisfying (2), which can be solved by R[x]-lattice basis reduction algorithm.

2

R[x]-Lattice and Its Reduction Basis Algorithm

In this section we give some properties about R[x]−lattice and an R[x]-lattice basis reduction algorithm. Let n be an arbitrary positive integer, then An denotes the free A−module A ⊕ · · · ⊕ A with rank n. The standard basis of An consists of the elements ε1 = (1A , 0, · · · , 0), ε2 = (0, 1A, 0, · · · , 0), εn = (0, · · · , 0, 1A), where 1A is the identity element of A. Apparently 1A = 1R , and so is simply denoted 1 in the sequel. For any element in An , we use its coordinates under the standard basis to represent it and so also call an element in An a vector. A subset Λ of An is an R[x]-lattice if there exists a basis ω1 , · · · , ωn of An such that Λ = Λ(ω1 , · · · , ωn ) =

n X

R[x]ωi .

(3)

i=1

In this situation we say that ω1 , · · · , ωn form a basis for Λ. Obviously, an R[x]lattice may be also defined by a free R[x]-submodule of An with rank n. The determinant d(Λ) of a lattice Λ is defined by d(Λ) = v(det(ω1 , · · · , ωn )) .

(4)

We define a map on An , denoted by V . V : An β = (bi (x))1≤i≤n

−→ Z ∪ {∞} ∞ β=0 7−→ min{v(bi (x))|1 ≤ i ≤ n} otherwise

Let be a real number with 0 < < 1 and the length function L : An −→ R≥0 is given by β 7−→ V (β) . Besides, we define a projection. For any integer k, −→ Rn θk : An β = (bi (x))1≤i≤n 7−→ (bi,k )T1≤i≤n where bi (x) = matrix.

P∞

j=j0 bi,j x

−j

, 1 ≤ i ≤ n, and T denotes the transpose of a

Multisequence Synthesis over an Integral Domain

209

Definition 1. A basis ω1 , · · · , ωn of a lattice Λ is reduced if the set {θV (ωi ) (ωi ) ∈ Rn | 1 ≤ i ≤ n} is R-linearly independent. Definition 2. A subset of a lattice is a sublattice if itself is also a lattice with rank n. Lemma 2. Let B ∈ Matn (R), then the rows (columns) of B are R-linearly independent if and only if its determinant |B| 6= 0. Proof. Let K be the quotient field of the integral domain R. Then |B| 6= 0 over K if and only if the rows (columns) of B are K-linearly independent. Since R is an integral domain, the rows (columns) of B are R-linearly independent if and only if they are K- linearly independent. In addition, |B| 6= 0 over R if and only if |B| 6= 0 over K. Hence the conclusion is proved. t u Lemma 3. Let ω1 , · · · , ωn be a basis of a lattice Λ and ∆(ω1 , · · · , ωn) = d(Λ) −

n X

V (ωi ) .

(5)

i=1

Then ∆(ω1 , · · · , ωn ) ≥ 0. The equality holds if and only if the basis ω1 , · · · , ωn is reduced. Proof. We use the notation ωi = θV (ωi ) (ωi )x−V (ωi ) + · · ·

(i = 1, · · · , n) .

(6)

So we have det(ω1 , · · · , ωn) = x−(V (ω1 )+···+V (ωn )) det(θV (ω1 ) (ω1 ), · · · , θV (ωn ) (ωn )) + · · · (7) −1 where · · · at the right indicates terms Pn with x raised to exponents larger than V (ω1 ) + · · · + V (ωn ). Thus d(Λ) ≥ i=1 V (ωi ). By Lemma 2, the equality holds t u if and only if the basis ω1 , · · · , ωn is reduced.

Lemma 4. Let ω1 , · · · , ωn be a basis of a lattice Λ and ui ∈ R∗ , for all i, 1 ≤ i ≤ n, where R∗ denotes R/{0}. Then 1. u1 ω1 , · · · , unωn are also a basis of An . 2. The lattice Λ(u1 ω1 , · · · , un ωn ) is a sublattice of lattice Λ(ω1 , · · · , ωn) and Λ(u1 ω1 , · · · , unωn ) = Λ(ω1 , · · · , ωn) if and only if u1 u2 · · · un is a unit in R. 3. d(Λ(u1 ω1 , · · · , un ωn )) = d(Λ(ω1 , · · · , ωn )). Proof. Properties 1. and 2. are easily obtained. As to 3., it follows from the t u identity det(u1 ω1 , · · · , un ωn ) = u1 · · · un det(ω1 , · · · , ωn ). We give an algorithm as follows.

210

Li-ping Wang and Yue-fei Zhu

Algorithm 1 Input: ω1 , · · · , ωn are a basis of a lattice and set (φ1 , · · · , φn ) := (ω1 , · · · , ωn ). Output: a reduced basis for some sublattice of a lattice Λ(ω1 , · · · , ωn). 1. For i := 1 to n doPbegin Set ui := 1 end; n 2. Set ∆ := d(Λ) − i=1 V (φi ) and r := 0; 3. While ∆ > 0 Do begin – Set r := r + 1; – Put (φ1 , · · · , φn ) := (φρ(1) , · · · , φρ(n)) (u1 , · · · , un ) := (uρ(1) , · · · , uρ(n)), where some permutation ρ ∈ Sn such that V (φ1 ) ≥ · · · ≥ V (φn ); – Set M := (θV (φ1 ) (φ1 ), · · · , θV (φn ) (φn )); – (reduction step) Find a nonzero solution (c1 , · · · , cn )T of the equation system M x = 0 and determine j such that 2 ≤ j ≤ n, cj 6= 0 and ci = 0 for i > j, and so set φj := cj φj +

j−1 X

ci xV (φi )−V (φj ) · φi

and

uj := cj uj ;

i=1

Pn – Set ∆ := d(Λ) − i=1 V (φi ); end; 4. Output r, u1, · · · , un and φ1 , · · · , φn . Remark 1. 1. By algorithm 1, we get a reduced basis for a sublattice Λ(u1 ω1 , · · · , un ωn ) of lattice Λ(ω1 , · · · , ωn ), where u1 , · · · , un are the output. Therefore it possibly is not a basis of the lattice Λ(ω1 , · · · , ωn ). Especially if R is a finite field, it is also a reduced basis of lattice Λ(ω1 , · · · , ωm ) by Lemma 4. 2. We define ψ : {(φ1 , · · · , φn )|φ1 , · · · , φn are a basis in Algorithm 1} −→ Z n X V (φi ) (φ1 , · · · , φn ) 7−→ d(Λ(φ1 , · · · , φn )) − i=1

Assume φ1 , · · · , φn are a current basis for a sublattice Λ(u1 ω1 , · · · , un ωn ) yielded at the beginning of the each while-loop. By Lemma 4, we know d(Λ(φ1 , · · · , φn )) = d(Λ(ω, · · · , ωn )). Thus in Algorithm 1 the value ∆ strictly decreases and ∆ = 0 implies φ1 , · · · , φn becomes reduced by Lemma 3. So the algorithm terminates after at most ψ(ω1 , · · · , ωn ) steps.

Multisequence Synthesis over an Integral Domain

211

3. In Algorithm 1, we have to find a solution of the equation system M x = 0 over R. We solve it over K, where K is the quotient field of R. Thus we get a solution in R by multiplying denominators. In the following discussion we develop some properties about reduced basis. To simplify mathematical expressions, we denote πn the n−th component of a vector in Rn , Lcf(f(x)) the leading coefficient of f(x) and degf(x) the degree of f(x). Define degf(x) = −∞ if f(x) = 0. Let ω1 , · · · , ωn be a reduced basis of a lattice Λ and V (ω1 ) ≥ · · · ≥ V (ωn ). If any vector β ∈ Λ(ω1 , · · · , ωn ), then β is a linear combination β = f1 (x)ω1 + · · · + fn (x)ωn with fi (x) ∈ R[x] for 1 ≤ i ≤ n. Set di = deg(fi (x)), ci = Lcf (fi (x)), d(β) = min{V (ωi ) − di |1 ≤ i ≤ n}, I(β) = {i| 1 ≤ i ≤ n, V (ωi ) − di = d(β)}. Since the following proofs are similar to those in [5], we omit them here. Lemma 5. With above notation, then d(β) = V (β). Lemma 6. With above notation, if V (β) > V (ωt ) with some t, 1 ≤ t ≤ n, then ft (x) = · · · = fn (x) = 0. Note 1. Especially in the case t = 1, we know β = 0, i.e. ω1 is a shortest length vector in all non-zero vectors of Λ according to Lemma 6. Theorem 1. Let ω1 , · · · , ωn be a reduced basis of a lattice Λ with V (ω1 ) ≥ · · · ≥ V (ωn ) and S(Λ) = {β ∈ Λ(ω1 , · · · , ωn )| πn (θV (β) (β)) 6= 0} .

(8)

/ S(Λ) for j < s. Then ωs is a Let s satisfy 1 ≤ s ≤ n , ωs ∈ S(Λ) and ωj ∈ vector with shortest length in S(Λ).

3

Multisequence Synthesis Algorithm

In this section we present a multisequence synthesis algorithm based on the above R[x]-lattice basis reduction algorithm. Furthermore, we consider the uniqueness of minimal polynomials. Let a(i) (x), 1 ≤ i ≤ m, be the associated formal negative-power series of the sequences a(i) . We construct m + 1 vectors in Am+1 and set e1 = (−1, 0, · · · , 0)m+1 , .. . em = (0, · · · , 0, −1, 0)m+1 , α = (a(1)(x), · · · , a(m) (x), x−N−1 )m+1 .

212

Li-ping Wang and Yue-fei Zhu

Obviously e1 , · · · , em , α are A-linearly independent. Therefore they span an R[x]-lattice Λ with rank m + 1. In detail, m X pi (x)ei | pi (x), q(x) ∈ R[x], 1 ≤ i ≤ m . Λ(e1 , · · · , em , α) = q(x) · α + i=1

Then we have d(Λ) = N + 1. Set Ω = S(Λ(e1 , · · · , em , α)). Γ = Ann(a(1) , a(2), · · · , a(m) ). For any q(x) ∈ Γ , it follows from Lemma 1 that for each i, 1 ≤ i ≤ m, there exists a unique polynomial pi (x) ∈ R[x] such that v(q(x)· ai (x)−pi (x)) > N −d, where d is the degree of q(x). However, v(q(x) · x−(N+1) ) = N + 1 − d and hence we obtain a unique vector β in Ω. Write β = (q(x) · a(1)(x) − p1 (x), · · · , q(x) · a(m) (x) − pm (x), q(x) · x−(N+1) ). So a map ϕ : Γ −→ Ω is well defined by q(x) 7−→ β. Define two natural total orderings, i.e. Ω is ordered by length of a vector and Γ by degree of a polynomial. Theorem 2. The map ϕ : Γ −→ Ω is an order-preserving bijection. The proof of Theorem 2 is omitted because of the similarity to Theorem 2 [5]. By means of Algorithm 1, we get a reduced basis ω1 , · · · , ωm+1 for the sublattice Λ(u1 e1 , · · · , umem , um+1 α) of a lattice Λ(e1 , · · · , em , α) with V (ω1 ) ≥ · · · ≥ V (ωm+1 ), where u1 , · · · , um+1 is the output. Let s satisfy 1 ≤ s ≤ m + 1, πm+1 (θV (ωs ) (ωs )) 6= 0 and πm+1 (θV (ωi ) (ωi )) = 0, for i < s. From Theorem 1, we know ωs is a vector with shortest length in S(Λ(u1 e1 , · · · , um em , um+1 α)). For convenience, set S = S(Λ(u1 e1 , · · · , um em , um+1 α)). Furthermore we have: Theorem 3. The vector ωs is also a vector with shortest length in Ω. Proof. Let β be a vector in Ω with shortest length. It is obvious that V (ωs ) ≥ V (β). Setting γ = u1 · · · um+1 β, then γ is in S and V (γ) = V (β). Thus V (γ) ≥ t u V (ωs ) and so V (ωs ) = V (β). By Theorem 2, there is a one-to-one correspondence between annihilating polynomials in Γ and vectors in Ω. We get a reduced basis ω1 , · · · , ωm+1 of the lattice Λ(u1 e1 , · · · , um em , um+1 α) by Algorithm 1. It easily follows from Theorem 3 that ωs is also a vector with shortest length in Ω and hence ϕ−1 (ωs ) is a minimal polynomial of a(1) , a(2), · · · , a(m) . The above ideas lead to Algorithm 2. Algorithm 2 Input: m sequences a(1), a(2), · · · , a(m) , each of length N , over R. Output: a minimal polynomial of a(1) , a(2), · · · , a(m).

Multisequence Synthesis over an Integral Domain

213

1. Compute the associated formal negative-power series, i.e. a(i) (x) :=

N X

aj x−j , (i)

1 ≤ i ≤ m;

j=1

2. 3. 4. 5.

Set n := m + 1 and ω1 := e1 , · · · , ωn−1 := em , ωn := α; Execute Algorithm 1 and output r, u1 , · · · , un and φ1 , · · · , φn . Let s satisfy 1 ≤ s ≤ n and πn (θV (φs ) (φs )) 6= 0; Compute q(x) := ϕ−1 (φs ) and output q(x).

Remark 2. It takes at most N reduction steps according to Remark 1. And in each reduction step at most N multiplications in R are needed. So the computational complexity is O(N 2 ) operations in R. We know r is the total number of the reduction steps. Let each k, 0 ≤ k ≤ r, be a superscript number such that the basis (k)

(k)

(k)

ω1 , ω2 , · · · , ωm+1 for some sublattice denotes the current basis yielded in the k-th while-loop. Analogous to Lemma 4 [5], we also have: Lemma 7. Assume 0 ≤ k ≤ r. Then the set o n (k) θV (ω(k) ) (ωi )|1 ≤ i ≤ m + 1 i

is R-linearly dependent, but there exist m vectors in it which are R-linearly independent and their m + 1-th components are 0. From Lemma 7, we easily get the following Lemma. Lemma 8. Let ω1 , ω2 , · · · , ωm+1 be a reduced basis for the sublattice Λ(u1 e1 , · · · , um em , um+1 α) by Algorithm 1. Then there is a unique integer s such that 1 ≤ s ≤ m + 1 and πm+1 (θV (ωs ) (ωs )) 6= 0. The subsequent discussion is devoted to the uniqueness about minimal polynomials. Recall that a, b ∈ R∗ are associates if there is a unit u ∈ R∗ such that a = ub. This defines an equivalence relation: [b] denotes the class of associates of b ∈ R∗ and [R∗ ] denotes the set of associate classes of R∗ . Therefore, two polynomials f1 (x) and f2 (x) are equivalent if and only if there exists a unit u ∈ R∗ such that f1 (x) = uf2 (x). The vectors β , γ ∈ Λ(e1 , · · · , em , α) are equivalent if and only if β = uγ, where u is a unit in R. From now on we take the equivalent elements as one.

214

Li-ping Wang and Yue-fei Zhu

Theorem 4. Let ω1 , ω2 , · · · , ωm+1 be a reduced basis of the sublattice Λ(u1 e1 , · · · , um em , um+1 α) by Algorithm 1 and V (ω1 ) ≥ · · · ≥ V (ωm+1 ). Write c = Lcf (ϕ−1 (ωs )), where s is defined same as in Lemma 8. Then the shortest length vector in S is unique if and only if s = 1 , V (ω1 ) > V (ω2 ) and the equation cx = b with any element b ∈ R∗ and [b] 6= [c] has no solution in R. Proof. Suppose a vector β ∈ S with V (β) = V (ω1 ). Then β is a linear combination β = f1 (x)ω1 + · · · + fm+1 (x)ωm+1 with fi (x) ∈ R[x] for 1 ≤ i ≤ m + 1. Since V (β) > V (ω2 ), we have f2 (x) = · · · = fm+1 (x) = 0 according to Lemma 6 and β = f1 (x) · ω1 . Because of V (β) = V (ω1 ), we know f1 (x) = a ∈ R∗ . Let b =Lcf(ϕ−1 (β)), then b = ac and so [b] = [c]. Thus a is a unit in R and β and ωs belong to same equivalent class, i.e. the shortest length vector in S is unique. Conversely, suppose s 6= 1. Setting β = xV (ω1 )−V (ωs ) ω1 + ωs , then β ∈ S, V (β) = V (ωs ) and Lcf(ϕ−1 (β)) = c. Since β 6= ωs , then ϕ−1 (β) 6= ϕ−1 (ωs ), a contradiction to the uniqueness. Suppose s = 1 and V (ω1 ) = V (ω2 ). From / S. Putting β = ω1 + ω2 , then β ∈ S, V (β) = V (ω1 ) and Lemma 8, we know ω2 ∈ Lcf(ϕ−1 (β)) = c. But β 6= ω1 and ϕ−1 (β) 6= ϕ−1 (ω1 ), which also contradicts with the uniqueness. Suppose there exists b ∈ R∗ and [b] 6= [c] such that the equation cx = b has a solution in R. Setting β = b ω1 , then V (β) = V (ω1 ), but t u β and ω1 are not same equivalent class. Theorem 5. Let ω1 , ω2 , · · · , ωm+1 be a reduced basis of the sublattice Λ(u1 e1 , · · · , um em , um+1 α) by Algorithm 1 and V (ω1 ) ≥ · · · ≥ V (ωm+1 ). Write c = Lcf (ϕ−1 (ωs )), where s is defined same as in Lemma 8. Then the minimal polynomial of a(1) , a(2), · · · , a(m) is unique if and only if s = 1 , V (ω1 ) > V (ω2 ) , the equation cx = b with any element b ∈ [R∗ ] and [b] 6= [c] has no solution in R and u1 · u2 · · · um+1 is a unit in R. Proof. Since S ⊆ Ω, it suffices to show the shortest length vector in Ω is unique if and only if the shortest length vector in S is unique and u1 · · · um+1 is a unit in R from Theorem 2, Theorem 3 and Theorem 4. Suppose u1 · · · um+1 is not a unit in R. Then u1 · · · um+1 ωs and ωs are not same equivalent class, a contradiction to the uniqueness. Conversely, Suppose there exists a vector β ∈ Ω and β 6= uωs , for all u is a unit in R. Then u1 · · · um+1 β ∈ S, also a contradiction to the uniqueness of the shortest vector in S. t u Theorem 6. Let ω1 , ω2 , · · · , ωm+1 be a reduced basis of the sublattice Λ(u1 e1 , · · · , um em , um+1 α)

Multisequence Synthesis over an Integral Domain

215

by Algorithm 1 and V (ω1 ) ≥ · · · ≥ V (ωm+1 ). Assume V (ωs ) = V (ωs+1 ) = · · · = V (ωt ) > V (ωt+1 ), where s is defined same as the above and s ≤ t ≤ m + 1. Then the set W which contains all shortest length vectors in S is   deg(fi ) ≤ V (ωi ) − V (ωs )           (x) ∈ R[x] for all 1 ≤ i ≤ s − 1 f   i s−1 t  X X fi (x)ωi + cs ωs + cj ωj cj runs all of R W =     i=1 j=s+1   s+ 1 ≤ j ≤ t         cs c runs all of [R∗ ] Proof. Assume β is a vector in S with shortest length. Then β is a linear combination β = f1 (x)ω1 + · · · + fm+1 (x)ωm+1 with fi (x) ∈ R[x] for 1 ≤ i ≤ m + 1. Since V (β) = V (ωs ) > V (ωt+1 ), we have ft+1 (x) = · · · = fm+1 (x) = 0 by Lemma 6 and d(β) = V (β) by Lemma 5. If 1 ≤ i ≤ s − 1, we have V (ωi ) − deg(fi (x)) ≥ d(β) = V (ωs ). If s ≤ i ≤ t, we obtain V (ωi ) − deg(fi (x)) ≥ d(β) = V (ωs ). Thus deg(fi (x)) = 0 and so write β = f1 (x)ω1 + · · · + fs−1 (x)ωs−1 + cs ωs + · · · + ct ωt with ci ∈ R for all i, s ≤ i ≤ t. Setting w = f1 (x)ω1 + · · · + fs−1 (x)ωs−1

and

u=

t X

cj ω j ,

j=s+1

it follows that cs c ∈ [R∗] from πm+1 (θV (β) (β)) 6= 0,

πm+1 (θV (w) (w)) = 0,

and

πm+1 (θV (u) (u)) = 0.

Conversely, for any vector β ∈ W , then V (β) = V (ωs ) and β ∈ S.

t u

Corollary 1. The set U of all shortest length vectors in Ω is given by U = {β ∈ Ω|u1 · · · um+1 β = γ, where γ runs all W } From Corollary 1 and Theorem 2 we easily get all minimal polynomials of a(1), a(2), · · · , a(m) . Note 2. If R is a finite field, for any element b ∈ R∗ , then [b] = [1] and so there are no such equation cx = b with c =Lcf(ϕ−1 (ωs )) and [c] 6= [b]. Therefore our results are in accord with those in [5].

216

4

Li-ping Wang and Yue-fei Zhu

An Example

In this section a concrete example is presented. Given a(1) = (1, −2, 0, 4, −4) and a(2) = (0, 1, −1, −1, 3) two sequences over integers ring Z. Find a minimal polynomial. First we calculate the formal-negative series of a(1) and a(2) , i.e., a(1) (x) = x−1 − 2x−2 + 4x−4 − 4x−5 , a(2) (x) = x−2 − x−3 − x−4 + 3x−5 . Setting ω1 = (a(1) (x), a(2)(x), x−6 ),

ω2 = (−1, 0, 0),

and

ω3 = (0, −1, 0),

we have V (ω1 ) = 1, θV (ω1 ) (ω1 ) = (1, 0, 0)T ,

V (ω2 ) = V (ω3 ) = 0,

θV (ω2 ) (ω2 ) = (−1, 0, 0)T ,

∆ ← 5, θV (ω3 ) (ω3 ) = (0, −1, 0)T .

Putting M ← (θV (ω1 ) (ω1 ), · · · , θV (ω3 ) (ω3 )), then (1, 1, 0)T is a solution of the equation system M x = 0 and so set ω2 ← ω2 + xω1 = (−2x−1 + 4x−3 − 4x−4 , x−1 − x−2 − x−3 + 3x−4 , x−5 ). Thus V (ω1 ) = 1, θV (ω1 ) (ω1 ) = (1, 0, 0) , T

V (ω2 ) = 1, V (ω3 ) = 0,

θV (ω2 ) (ω2 ) = (−2, 1, 0) , T

∆ ← 4, θV (ω3 ) (ω3 ) = (0, −1, 0)T .

Then (2, 1, 1)T is a solution of new equation system M x = 0 and so set ω3 ← ω3 + xω2 + 2xω1 = (−4x−1 + 4x−2 + 4x−3 − 8x−4 , x−1 − 3x−2 + x−3 + 6x−4 , x−4 + 2x−5 ). We get V (ω1 ) = 1, θV (ω1 ) (ω1 ) = (1, 0, 0) , T

V (ω2 ) = 1, V (ω3 ) = 1,

θV (ω2 ) (ω2 ) = (−2, 1, 0) , T

∆ ← 3, θV (ω3 ) (ω3 ) = (−4, 1, 0)T .

Thus (2, −1, 1)T is a solution of M x = 0 and hence set ω3 ← ω3 − ω2 + 2ω1 = (4x−4 − 8x−5 , x−4 + 6x−5 , x−4 + x−5 + 2x−6 ). We obtain V (ω1 ) = 1,

V (ω2 ) = 1,

V (ω3 ) = 4,

∆ ← 0.

So that we get a reduced basis and q(x) = x + x + 2 is a minimal polynomial. 2

Multisequence Synthesis over an Integral Domain

5

217

Conclusion

When applied to single sequence synthesis, we can derive an algorithm equivalent to Norton algorithm [3]. Because of space limitations, we omit it in this paper.

References 1. 2. 3. 4. 5. 6. 7. 8. 9. 10.

Fitzpatrick, P., Norton, G. H.: The Berlekamp-Massey algorithm and linear recurring sequences over a factorial domain. AAECC, 6 (1995) 309–323 Lu, P. Z., Liu, M. L.: Gr¨ obner basis for characteristic ideal of linear recurrence sequence over U F D. Science in China (Series A), vol.28, No. 6. 508–519 (1998) Norton, G. H.: On shortest linear recurrences. J. Symb. Comp. 27 (1999) 325–349 Schmidt, W. M.: Construction and estimation of bases in function fields. J. Number Theory 39, no. 2, 181–224 (1991) Wang, L. P., Zhu, Y. F.: F [x]-lattice basis reduction algorithm and multisequence synthesis. Science in China, in press Lenstra, A. K., Lenstra, H. W., Lovasz, L.: Factoring polynomials with rational coefficients. Math. Ann., vol. 261 (1982) 515–534 Lagarias, J. C. , Odlyzko, A. M.: Soluting low density subset problems. Pro. 24th Annual IEEE Symp. on Found of Comp. Science (1983) 1–10 Coppersmith, D.: Small solutions to polynomial equations and low exponent RSA vulnerabilities. Journal of Cryptology 10 (1997) 233–260 Berlekamp, E. R.: Algebraic Coding Theory. New York: McGrawHill (1968) Massey, J. L.: Shift-register synthesis and BCH decoding. IEEE Trans. Inform. Theory, vol. IT-15, no. 1, 122-127 (1969)

Author Index

Ajtai, Mikl´ os, 1

Nguyen, Phong Q., 97, 146

Bl¨ omer, Johannes, 4

Rote, G¨ unter, 32

Coppersmith, Don, 20

Schnorr, Claus Peter, 67, 81 Semanov, Igor, 181 Shparlinski, Igor E., 97 Silverman, Joseph H., 110 Sivakumar,Dandapani, 1 Stern, Jacques, 146

Eisenbrand,Friedrich, 32 Hoeij, Mark van, 45 Howgrave-Graham, Nick, 51 Koy, Henrik, 67, 81 Kumar, Ravi, 1 Mahassni, Edwin El, 97 May, Alexander, 4, 110 Micciancio, Daniele, 126

Trolin, M˚ arten, 194 Wang, Li-ping 206 Zhu, Yue-fei, 206